CVE-2024-42302

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal

Keith reports a use-after-free when a DPC event occurs concurrently to

hot-removal of the same portion of the hierarchy:

The dpc_handler() awaits readiness of the secondary bus below the

Downstream Port where the DPC event occurred. To do so, it polls the

config space of the first child device on the secondary bus. If that

child device is concurrently removed, accesses to its struct pci_dev

cause the kernel to oops.

That's because pci_bridge_wait_for_secondary_bus() neglects to hold a

reference on the child device. Before v6.3, the function was only

called on resume from system sleep or on runtime resume. Holding a

reference wasn't necessary back then because the pciehp IRQ thread

could never run concurrently. (On resume from system sleep, IRQs are

not enabled until after the resume_noirq phase. And runtime resume is

always awaited before a PCI dev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References