CVE-2024-38630

Description

In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If the timer handler is running, del_timer() could not stop it and will return directly. If the port region is released by release_region() and then the timer handler cpu5wdt_trigger() calls outb() to write into the region that is released, the use-after-free bug will happen. Change del_timer() to timer_shutdown_sync() in order that the timer handler could be finished before the port region is released.

CVSS Metrics

• v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.03%• Percentile: 9%

Techniques & Countermeasures

• CWE-416•Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

• linux•linux

  ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9b1c063ffc075abf56f63e55d70b9778ff534314 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f19686d616500cd0d47b30cee82392b53f7f784a | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 573601521277119f2e2ba5f28ae6e87fc594f4d4 | 2.6.12

• linux•linux_kernel

  ≥ 3.8, < 6.6.33 | ≥ 6.7, < 6.9.4

References (3)

• https://git.kernel.org/stable/c/9b1c063ffc075abf56f63e55d70b9778ff534314
• https://git.kernel.org/stable/c/f19686d616500cd0d47b30cee82392b53f7f784a
• https://git.kernel.org/stable/c/573601521277119f2e2ba5f28ae6e87fc594f4d4