Executive brief
A vulnerability exists in the Linux kernel's Consumer Electronics Control (CEC) framework, which manages communication between multimedia devices like TVs and players. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized control over the system. This affects various Linux-based systems, including industrial automation components like the Siemens SIMATIC S7-1500.
Technical details
A use-after-free (UAF) vulnerability exists in the cec_queue_msg_fh function within drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c. The flaw is caused by a race condition where one thread holds a lock on a 'struct cec_fh' while another thread frees the same structure without proper synchronization. When the first thread subsequently attempts to access the freed memory (specifically fh->msgs), a KASAN-detected slab-use-after-free occurs. This can be triggered via the cec_ioctl system call. While primarily resulting in a kernel crash (DoS), the presence of function pointers in the affected structure suggests a potential for privilege escalation.
Affected products
- Linux Linux Kernel up to and including 6.7.1
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions
Timeline
- 2024-01-18: disclosed: Vulnerability details shared on Linux Kernel Mailing List (LKML)
- 2024-01-23: advisory: CVE-2024-23848 published by MITRE/NVD
- 2024-04-09: advisory: Siemens published advisory SSA-265688 confirming impact on SIMATIC S7-1500 TM MFP