Use After Free Vulnerability in Linux Kernel's svc_i3c_master Driver
Summary
DEBIAN-CVE-2024-49874: In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition In the svc_i3c_master_probe function, &master->hj_work... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The 'linux' package in Debian versions 13 and 14 is crucial for system stability and performance. This package includes various drivers, including the svc_i3c_master driver, which manages I3C (Improved Inter-Integrated Circuit) devices. The vulnerability in question arises from a race condition that can lead to a use-after-free (UAF) scenario, potentially compromising system integrity.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the svc_i3c_master driver. This issue occurs in the svc_i3c_master_probe function, where two work items, hj_work and ibi_work, are linked to the master structure. If the module is removed while these work items are still in use, it can lead to a situation where the memory allocated for master->base is freed while still being accessed by the work items. This race condition can allow an attacker to exploit the vulnerability, potentially leading to arbitrary code execution or system crashes.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The use-after-free vulnerability in the Linux kernel's svc_i3c_master driver poses significant risks to system integrity and security. Users are urged to update their systems to the patched version to protect against potential exploits. Regular monitoring and updates are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed. This can lead to unpredictable behavior, crashes, or security vulnerabilities.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to access the code.
If exploited, this vulnerability could allow an attacker to execute arbitrary code, leading to system crashes or unauthorized access to sensitive data.
Yes, if exploited, the vulnerability could lead to system instability and potential data loss, especially if critical processes are interrupted.
It is recommended to regularly check for updates and apply them promptly, especially for critical packages like the Linux kernel, to mitigate security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
