Junglewise Threat Intelligence

CVE-2024-50150: Linux Kernel use-after-free in USB Type-C altmode release

CVE-2024-50150 · Severity: high · CVSS 7.8 · Published 2024-11-07

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB Type-C driver could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs when the system handles USB 'alternate modes' (like DisplayPort over USB-C) and fails to properly track the relationship between hardware components during disconnection. This can lead to a memory error known as a 'use-after-free,' which impacts the overall stability and security of the operating system.

Technical details

A use-after-free vulnerability exists in drivers/usb/typec/class.c within the Linux kernel. The 'altmode' device release function (typec_altmode_release) attempts to access its parent device without having previously incremented the parent's reference count during registration. Consequently, if the parent device is released before the altmode device's delayed cleanup occurs, the kernel attempts to access freed memory. This was identified using KASAN and CONFIG_DEBUG_KOBJECT_RELEASE. An attacker with local access could exploit this race condition to cause a kernel panic or achieve local privilege escalation. The fix involves implementing proper reference counting by calling get_device() on the parent during registration and put_device() during release.

Affected products

  • Linux Linux Kernel Fixed in 6.12-rc1 and various stable branches (6.11.7, 6.10.14, 6.6.60, 6.1.116, 5.15.171, 5.10.229, 5.4.285)

Timeline

  • 2024-10-04: disclosed: Initial patch submitted to LKML
  • 2024-11-01: patched: Patch committed to stable trees
  • 2024-11-07: advisory: CVE-2024-50150 published

References

Related threats