CVE-2024-49874
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-49874
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49874.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-49874
- Downstream
- Related
- Published
- 2024-10-21T18:01:14Z
- Modified
- 2025-10-15T16:49:46.953267Z
- Summary
- i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: svc: Fix use after free vulnerability in svci3cmaster Driver Due to Race Condition
In the svci3cmasterprobe function, &master->hjwork is bound with svci3cmasterhjwork, &master->ibiwork is bound with svci3cmasteribiwork. And svci3cmasteribiwork can start the hjwork, svci3cmasterirqhandler can start the ibi_work.
If we remove the module which will call svci3cmasterremove to make cleanup, it will free master->base through i3cmaster_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| svc_i3c_master_hj_worksvci3cmasterremove | i3cmasterunregister(&master->base)| deviceunregister(&master->dev) | devicerelease | //free master->base | | i3cmasterdodaa(&master->base) | //use master->base
Fix it by ensuring that the work is canceled before proceeding with the cleanup in svci3cmaster_remove.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/27b55724d3f781dd6e635e89dc6e2fd78fa81a00
- https://git.kernel.org/stable/c/4318998892bf8fe99f97bea18c37ae7b685af75a
- https://git.kernel.org/stable/c/4ac637122930cc4ab7e2c22e364cf3aaf96b05b1
- https://git.kernel.org/stable/c/56bddf543d4d7ddeff3f87b554ddacfdf086bffe
- https://git.kernel.org/stable/c/61850725779709369c7e907ae8c7c75dc7cec4f3
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced87e0f28eda36c7843523aa8dd0c5dab3331e9718Fixed56bddf543d4d7ddeff3f87b554ddacfdf086bffe
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7Fixed4ac637122930cc4ab7e2c22e364cf3aaf96b05b1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7Fixed4318998892bf8fe99f97bea18c37ae7b685af75a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7Fixed27b55724d3f781dd6e635e89dc6e2fd78fa81a00
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7Fixed61850725779709369c7e907ae8c7c75dc7cec4f3
Affected versions
v6.*
Database specific
{
"vanir_signatures": [
{
"id": "CVE-2024-49874-78fd2aff",
"signature_type": "Line",
"target": {
"file": "drivers/i3c/master/svc-i3c-master.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"305332054609222264757079223340452996073",
"201032073115062260719368493882519536530",
"70606614684647688786454425219541058342"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56bddf543d4d7ddeff3f87b554ddacfdf086bffe"
},
{
"id": "CVE-2024-49874-c59c1173",
"signature_type": "Function",
"target": {
"file": "drivers/i3c/master/svc-i3c-master.c",
"function": "svc_i3c_master_remove"
},
"signature_version": "v1",
"digest": {
"length": 178.0,
"function_hash": "244370420548098976851651582795020009588"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56bddf543d4d7ddeff3f87b554ddacfdf086bffe"
}
]
}