CVE-2024-38385

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()

irq_find_at_or_after() dereferences the interrupt descriptor which is

returned by mt_find() while neither holding sparse_irq_lock nor RCU read

lock, which means the descriptor can be freed between mt_find() and the

dereference:

CPU0 CPU1

desc = mt_find()

delayed_free_desc(desc)

irq_desc_get_irq(desc)

The use-after-free is reported by KASAN:

Call trace:

irq_get_next_irq+0x58/0x84

show_stat+0x638/0x824

seq_read_iter+0x158/0x4ec

proc_reg_read_iter+0x94/0x12c

vfs_read+0x1e0/0x2c8

Freed by task 4471:

slab_free_freelist_hook+0x174/0x1e0

__kmem_cache_free+0xa4/0x1dc

kfree+0x64/0x128

irq_kobj_release+0x28/0x3c

kobject_put+0xcc/0x1e0

delayed_free_desc+0x14/0x2c

rcu_do_batch+0x214/0x720

Guard the access with a RCU rea

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References