CVE-2024-39495

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-39495
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39495.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-39495
Downstream
Published
2024-07-12T13:15:12Z
Modified
2025-08-09T20:01:28Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

greybus: Fix use-after-free bug in gbinterfacerelease due to race condition.

In gbinterfacecreate, &intf->modeswitchcompletion is bound with gbinterfacemodeswitchwork. Then it will be started by gbinterfacerequestmodeswitch. Here is the relevant code. if (!queuework(systemlongwq, &intf->modeswitch_work)) { ... }

If we call gbinterfacerelease to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gbinterfacemodeswitchwork is scheduled to run after kfree, it may cause use-after-free error as gbinterfacemodeswitchwork will use the object "intf". The possible execution flow that may lead to the issue is as follows:

CPU0 CPU1

                        |   gb_interface_create
                        |   gb_interface_request_mode_switch

gbinterfacerelease | kfree(intf) (free) | | gbinterfacemodeswitchwork | mutex_lock(&intf->mutex) (use)

Fix it by canceling the work before kfree.

References

Affected packages