CVE-2024-49924

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: pxafb: Fix possible use after free in pxafb_task()

In the pxafb_probe function, it calls the pxafb_init_fbinfo function,

after which &fbi->task is associated with pxafb_task. Moreover,

within this pxafb_init_fbinfo function, the pxafb_blank function

within the &pxafb_ops struct is capable of scheduling work.

If we remove the module which will call pxafb_remove to make cleanup,

it will call unregister_framebuffer function which can call

do_unregister_framebuffer to free fbi->fb through

put_fb_info(fb_info), while the work mentioned above will be used.

The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

| pxafb_task

pxafb_remove |

unregister_framebuffer(info) |

do_unregister_framebuffer(fb_info) |

put_fb_info(fb_info) |

// free fbi->fb | set_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References