Use-After-Free Vulnerability in Linux Kernel - Affects Debian Packages
Summary
CVE-2024-49992: In the Linux kernel, the following vulnerability has been resolved: drm/stm: Avoid use-after-free issues with crtc and plane ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_enc... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system compromises. This specific vulnerability pertains to the Direct Rendering Manager (DRM) subsystem, which is crucial for graphics rendering in Linux environments.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified within the DRM subsystem, specifically related to the handling of crtc (Cathode Ray Tube Controller) and plane objects. The issue arises when the ltdc_load() function calls drm_crtc_init_with_planes(), drm_universal_plane_init(), and drm_encoder_init() with parameters allocated using devm_kzalloc(). This improper memory management can lead to use-after-free scenarios, potentially allowing attackers to execute arbitrary code or cause system crashes. The vulnerability was discovered by the Linux Verification Center.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel as described above.
Conclusion
The identified use-after-free vulnerability in the Linux kernel poses significant risks to systems running affected Debian packages. It is crucial for users to update their kernels promptly to ensure system security and stability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to arbitrary code execution or crashes.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
Yes, use-after-free vulnerabilities are considered critical as they can lead to severe security breaches, including remote code execution.
While there are no specific workarounds, it is essential to prioritize updating your kernel as soon as possible to mitigate the risk.
Detailed information can be found in the Linux kernel mailing list archives and security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
