Executive brief
A vulnerability exists in the Linux kernel's pvrusb2 driver, which manages certain USB TV tuner devices. A race condition during device disconnection can lead to a 'use-after-free' error, potentially causing a system crash or allowing unauthorized access to kernel memory. This could impact system stability and the confidentiality of data handled by the operating system.
Technical details
A use-after-free (UAF) vulnerability was identified in the pvrusb2 driver within the Linux kernel, specifically in the pvr2_context_set_notify function. The issue stems from a race condition where the 'disconnect_flag' is set before the notification process is complete. If a separate thread (Task B) checks this flag and frees the context memory while the first thread (Task A) is still accessing it, a UAF occurs. This was detected by Syzbot using KASAN. The fix involves reordering the assignment of the disconnect flag to ensure it occurs only after all relevant code in pvr2_context_disconnect() has executed. Patching is available across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 2.6.26 to 6.8.2
Timeline
- 2024-02-16: patched: Initial fix authored by Edward Adam Davis
- 2024-04-17: disclosed: CVE-2024-26875 published
References
- https://git.kernel.org/stable/c/0a0b79ea55de8514e1750884e5fec77f9fdd01ee
- https://git.kernel.org/stable/c/3a1ec89708d2e57e2712f46241282961b1a7a475
- https://git.kernel.org/stable/c/40cd818fae875c424a8335009db33c7b5a07de3a
- https://git.kernel.org/stable/c/8e60b99f6b7ccb3badeb512f5eb613ad45904592
- https://git.kernel.org/stable/c/ab896d93fd6a2cd1afeb034c3cc9226cb499209f
- https://git.kernel.org/stable/c/d29ed08964cec8b9729bc55c7bb23f679d7a18fb
- https://git.kernel.org/stable/c/eaa410e05bdf562c90b23cdf2d9327f9c4625e16