CVE-2024-49924

In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime.

• debian debian linux 11.0 • linux linux kernel (>= 2.6.27 < 4.19.323) • linux linux kernel (>= 4.20 < 5.4.285) • linux linux kernel (>= 5.5 < 5.10.227) • linux linux kernel (>= 5.11 < 5.15.168) • linux linux kernel (>= 5.16 < 6.1.113) • linux linux kernel (>= 6.2 < 6.6.55) • linux linux kernel (>= 6.7 < 6.10.14) • linux linux kernel (>= 6.11 < 6.11.3)