Executive brief
A vulnerability in the Linux kernel's LED subsystem could allow a local user to cause a system crash or potentially execute unauthorized code. The issue stems from how the system handles LED triggers, which are components that control how hardware lights (like status LEDs) behave. An attacker could exploit a timing window during the deactivation of these triggers to access memory that has already been freed, leading to unpredictable system behavior.
Technical details
A use-after-free vulnerability exists in the Linux kernel LED subsystem (drivers/leds/led-triggers.c) due to an incorrect deactivation sequence. LED triggers with specific sysfs attributes store data in 'trigger-data' which is allocated during activation and freed during deactivation. The kernel was calling device_remove_groups() after the deactivate() callback; this created a race window where sysfs show/store functions could be invoked on already-freed memory. The fix reorders these calls to unregister sysfs attributes before deactivating the trigger. This is a local vulnerability requiring low privileges to exploit.
Affected products
- Linux Linux Kernel 4.19 to 4.19.320, 4.20 to 5.4.282, 5.5 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.103, 6.2 to 6.6.44, 6.7 to 6.10.3
Timeline
- 2024-05-04: other: Initial patch authored
- 2024-08-17: disclosed: CVE published
- 2024-08-19: patched: Stable kernel updates released
References
- https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2
- https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6
- https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d
- https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea
- https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3
- https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156
- https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374