Junglewise Threat Intelligence

CVE-2024-39493: Linux Kernel QAT crypto driver memory leak in ADF_DEV_RESET_SYNC

CVE-2024-39493 · Severity: medium · CVSS 5.5 · Published 2024-07-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's QuickAssist Technology (QAT) driver, which is used for hardware-accelerated cryptography and compression. A flaw in how the driver handles device resets can lead to memory leaks or system instability. In a worst-case scenario, a local attacker could exploit this to cause a system crash, resulting in a denial of service.

Technical details

A vulnerability in the Intel QuickAssist Technology (QAT) driver (drivers/crypto/qat) stems from improper synchronization during synchronous device resets (ADF_DEV_RESET_SYNC). The driver previously used completion_done() to determine if a caller was still present, which was insufficient and created a race condition. This could result in a memory leak of the reset_data structure or a use-after-free (UAF) if the caller had not yet reached wait_for_completion(). The fix replaces this logic with cancel_work_sync() to ensure the worker thread is stopped before memory is safely freed. The vulnerability is reachable locally and primarily impacts system availability.

Affected products

  • Linux Linux Kernel 4.19.312 to 4.19.316, 5.4.274 to 5.4.278, 5.10.215 to 5.10.219, 5.15.154 to 5.15.161, 6.1.84 to 6.1.94, 6.6.24 to 6.6.34, 6.9 to 6.9.5

Timeline

  • 2024-07-10: disclosed: Initial disclosure and publication of CVE-2024-39493
  • 2024-06-16: patched: Fixes committed to various stable kernel branches

References