Executive brief
The Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem contains a use-after-free memory flaw in the user destruction function. An attacker with local access could trigger this vulnerability to cause a kernel crash or potentially execute arbitrary code, affecting system availability and security.
Technical details
The vulnerability is a use-after-free bug in the _ipmi_destroy_user() function in drivers/char/ipmi/ipmi_msghandler.c. The root cause is that intf_free() releases the "intf" pointer, but the code immediately dereferences it again on the next line (module_put(intf->owner)). The fix stores the owner pointer before freeing the interface structure, then uses the saved pointer for the module_put call. This is a classic use-after-free that requires local access to trigger during IPMI device destruction. A patch has been available since Linux 5.5+.
Affected products
- Linux Linux kernel 5.5 and later versions before fix
Timeline
- 2022-11-15: disclosed
- 2023-01-07: patched