In the Linux kernel, the following vulnerability has been resolved:
media: xc2028: avoid use-after-free in loadfirmwarecb()
syzkaller reported use-after-free in loadfirmwarecb() [1]. The reason is because the module allocated a struct tuner in tuner_probe(), and then the module initialization failed, the struct tuner was released. A worker which created during module initialization accesses this struct tuner later, it caused use-after-free.
The process is as follows:
task-6504 workerthread tunerprobe <= alloc dvbfrontend [2] ... requestfirmwarenowait <= create a worker ... tunerremove <= free dvbfrontend ... requestfirmwareworkfunc <= the firmware is ready loadfirmwarecb <= but now the dvb_frontend has been freed
To fix the issue, check the dvdfrontend in loadfirmware_cb(), if it is null, report a warning and just return.
BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0
Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504
Call trace:
load_firmware_cb+0x1310/0x17a0
request_firmware_work_func+0x128/0x220
process_one_work+0x770/0x1824
worker_thread+0x488/0xea0
kthread+0x300/0x430
ret_from_fork+0x10/0x20
Allocated by task 6504:
kzalloc
tuner_probe+0xb0/0x1430
i2c_device_probe+0x92c/0xaf0
really_probe+0x678/0xcd0
driver_probe_device+0x280/0x370
__device_attach_driver+0x220/0x330
bus_for_each_drv+0x134/0x1c0
__device_attach+0x1f4/0x410
device_initial_probe+0x20/0x30
bus_probe_device+0x184/0x200
device_add+0x924/0x12c0
device_register+0x24/0x30
i2c_new_device+0x4e0/0xc44
v4l2_i2c_new_subdev_board+0xbc/0x290
v4l2_i2c_new_subdev+0xc8/0x104
em28xx_v4l2_init+0x1dd0/0x3770
Freed by task 6504:
kfree+0x238/0x4e4
tuner_remove+0x144/0x1c0
i2c_device_remove+0xc8/0x290
__device_release_driver+0x314/0x5fc
device_release_driver+0x30/0x44
bus_remove_device+0x244/0x490
device_del+0x350/0x900
device_unregister+0x28/0xd0
i2c_unregister_device+0x174/0x1d0
v4l2_device_unregister+0x224/0x380
em28xx_v4l2_init+0x1d90/0x3770
The buggy address belongs to the object at ffff8000d7ca2000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 776 bytes inside of
2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)
The buggy address belongs to the page:
page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0
flags: 0x7ff800000000100(slab)
raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
[2] Actually, it is allocated for struct tuner, and dvb_frontend is inside.
[
{
"id": "CVE-2024-43900-33e5840e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c",
"function": "load_firmware_cb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@850304152d367f104d21c77cfbcc05806504218b",
"digest": {
"length": 436.0,
"function_hash": "117912859508577820136303520257427264566"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-43900-488e427d",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@850304152d367f104d21c77cfbcc05806504218b",
"digest": {
"line_hashes": [
"305287264712382817597043167200654257946",
"55111592443686806655732474776938529564",
"24988514737844541599717608180021133888",
"92078161676563474709177228456557848545",
"270734994264940163238822677925291748961"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-43900-75c52c2e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c",
"function": "load_firmware_cb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@208deb6d8c3cb8c3acb1f41eb31cf68ea08726d5",
"digest": {
"length": 436.0,
"function_hash": "117912859508577820136303520257427264566"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-43900-85ff3b80",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef517bdfc01818419f7bd426969a0c86b14f3e0e",
"digest": {
"line_hashes": [
"305287264712382817597043167200654257946",
"55111592443686806655732474776938529564",
"24988514737844541599717608180021133888",
"92078161676563474709177228456557848545",
"270734994264940163238822677925291748961"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-43900-b655b843",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@208deb6d8c3cb8c3acb1f41eb31cf68ea08726d5",
"digest": {
"line_hashes": [
"305287264712382817597043167200654257946",
"55111592443686806655732474776938529564",
"24988514737844541599717608180021133888",
"92078161676563474709177228456557848545",
"270734994264940163238822677925291748961"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-43900-dc436af3",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c",
"function": "load_firmware_cb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68594cec291ff9523b9feb3f43fd853dcddd1f60",
"digest": {
"length": 436.0,
"function_hash": "117912859508577820136303520257427264566"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-43900-eb0c164b",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c",
"function": "load_firmware_cb"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef517bdfc01818419f7bd426969a0c86b14f3e0e",
"digest": {
"length": 436.0,
"function_hash": "117912859508577820136303520257427264566"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-43900-f1137a87",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/media/tuners/xc2028.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68594cec291ff9523b9feb3f43fd853dcddd1f60",
"digest": {
"line_hashes": [
"305287264712382817597043167200654257946",
"55111592443686806655732474776938529564",
"24988514737844541599717608180021133888",
"92078161676563474709177228456557848545",
"270734994264940163238822677925291748961"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]