Junglewise Threat Intelligence

CVE-2024-26875: Linux Kernel pvrusb2 use-after-free in pvr2_context_set_notify

CVE-2024-26875 · Severity: medium · CVSS 6.4 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's pvrusb2 driver, which manages certain USB TV tuner devices. A race condition during device disconnection can lead to a 'use-after-free' error, potentially causing a system crash or allowing unauthorized access to kernel memory. This could impact system stability and the confidentiality of data handled by the operating system.

Technical details

A use-after-free (UAF) vulnerability was identified in the pvrusb2 driver within the Linux kernel, specifically in the pvr2_context_set_notify function. The issue stems from a race condition where the 'disconnect_flag' is set before the notification process is complete. If a separate thread (Task B) checks this flag and frees the context memory while the first thread (Task A) is still accessing it, a UAF occurs. This was detected by Syzbot using KASAN. The fix involves reordering the assignment of the disconnect flag to ensure it occurs only after all relevant code in pvr2_context_disconnect() has executed. Patching is available across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.26 to 6.8.2

Timeline

  • 2024-02-16: patched: Initial fix authored by Edward Adam Davis
  • 2024-04-17: disclosed: CVE-2024-26875 published

References

Related threats