CVE-2024-39495

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

In gb_interface_create, &intf->mode_switch_completion is bound with

gb_interface_mode_switch_work. Then it will be started by

gb_interface_request_mode_switch. Here is the relevant code.

if (!queue_work(system_long_wq, &intf->mode_switch_work)) {

...

}

If we call gb_interface_release to make cleanup, there may be an

unfinished work. This function will call kfree to free the object

"intf". However, if gb_interface_mode_switch_work is scheduled to

run after kfree, it may cause use-after-free error as

gb_interface_mode_switch_work will use the object "intf".

The possible execution flow that may lead to the issue is as follows:

CPU0 CPU1

| gb_interface_create

| gb_interface_request_mode_switch

gb_interface_release |

kfree(intf) (free) |

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References