Use After Free Affecting kernel-uek-debug-devel package, versions <0:5.15.0-210.163.7.el8uek


Severity

Recommended
0.0
high
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use After Free vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ORACLE8-KERNELUEKDEBUGDEVEL-7942458
  • published13 Sept 2024
  • disclosed12 Jul 2024

Introduced: 12 Jul 2024

CVE-2024-39495  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade Oracle:8 kernel-uek-debug-devel to version 0:5.15.0-210.163.7.el8uek or higher.
This issue was patched in ELSA-2024-12618.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-debug-devel package and not the kernel-uek-debug-devel package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... }

If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows:

CPU0 CPU1

                        |   gb_interface_create
                        |   gb_interface_request_mode_switch

gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use)

Fix it by canceling the work before kfree.

CVSS Scores

version 3.1