UAF Vulnerability in Linux Kernel: mpc52xx SPI Module Removal Issue
Summary
CVE-2024-50051: In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregis... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resource allocation. The mpc52xx SPI (Serial Peripheral Interface) module is designed to facilitate communication between the CPU and peripheral devices. This module is critical for ensuring efficient data transfer in embedded systems. However, a recent vulnerability has been identified that could lead to a use-after-free (UAF) condition during module removal, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the mpc52xx SPI module where the function mpc52xx_spi_remove does not properly handle the cancellation of work items before the module is removed. When the module is removed, it calls spi_unregister_controller, which frees the memory associated with the work structure 'ms'. If the work is still in progress, this can lead to a use-after-free bug, where the system attempts to access freed memory, resulting in undefined behavior, crashes, or security vulnerabilities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified UAF vulnerability in the mpc52xx SPI module of the Linux kernel poses significant risks to system stability and security. It is crucial for users to update their systems to the patched versions to mitigate these risks. Regular monitoring and timely updates are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, which can lead to crashes or exploitation by attackers.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The consequences may include system crashes, data corruption, or exploitation by malicious actors, leading to unauthorized access or control over the system.
Yes, if exploited, this vulnerability could lead to data loss or corruption, as it may allow attackers to manipulate memory in unintended ways.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
