Executive brief
A vulnerability in the Linux kernel's Pulse Per Second (PPS) subsystem could allow a local user to cause a system crash or potentially execute unauthorized code. PPS is a mechanism used for high-precision timekeeping, often utilized by GPS devices and network time servers. The issue occurs when the system incorrectly handles the removal of these devices, leading to memory corruption that can destabilize the entire operating system.
Technical details
A use-after-free vulnerability exists in the Linux kernel PPS subsystem due to improper lifecycle management of the pps_device structure. The root cause is that pps_device_destruct() frees the pps_device (and its embedded cdev) immediately after calling cdev_del(), even though file operations for previously opened character devices may still be active. An attacker with local access could exploit this race condition during device removal or system shutdown to trigger memory corruption, refcount underflows, or a kernel panic. The fix involves decoupling the cdev from the pps_device structure and using __register_chrdev() with pps_idr to manage device minors and reference counting correctly.
Affected products
- Linux Linux Kernel 3.2.40 to 3.3, 3.4.87 to 6.13.2
Timeline
- 2024-11-11: patched: Initial patch authored
- 2025-02-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1a7735ab2cb9747518a7416fb5929e85442dec62
- https://git.kernel.org/stable/c/785c78ed0d39d1717cca3ef931d3e51337b5e90e
- https://git.kernel.org/stable/c/7e5ee3281dc09014367f5112b6d566ba36ea2d49
- https://git.kernel.org/stable/c/85241f7de216f8298f6e48540ea13d7dcd100870
- https://git.kernel.org/stable/c/91932db1d96b2952299ce30c1c693d834d10ace6
- https://git.kernel.org/stable/c/c4041b6b0a7a3def8cf3f3d6120ff337bc4c40f7
- https://git.kernel.org/stable/c/c79a39dc8d060b9e64e8b0fa9d245d44befeefbe