CVE-2024-43900

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: xc2028: avoid use-after-free in load_firmware_cb()

syzkaller reported use-after-free in load_firmware_cb() [1].

The reason is because the module allocated a struct tuner in tuner_probe(),

and then the module initialization failed, the struct tuner was released.

A worker which created during module initialization accesses this struct

tuner later, it caused use-after-free.

The process is as follows:

task-6504 worker_thread

tuner_probe <= alloc dvb_frontend [2]

...

request_firmware_nowait <= create a worker

...

tuner_remove <= free dvb_frontend

...

request_firmware_work_func <= the firmware is ready

load_firmware_cb <= but now the dvb_frontend has been freed

To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is

null, report a warning and just return.

[1]:

========

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References