UBUNTU-CVE-2024-36899
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines. Here is the typical stack when issue happened: [free] gpio_chrdev_release() --> bitmap_free(cdev->watched_lines) <-- freed --> blocking_notifier_chain_unregister() --> down_write(&nh->rwsem) <-- waiting rwsem --> __down_write_common() --> rwsem_down_write_slowpath() --> schedule_preempt_disabled() --> schedule() [use] st54spi_gpio_dev_release() --> gpio_free() --> gpiod_free() --> gpiod_free_commit() --> gpiod_line_state_notify() --> blocking_notifier_call_chain() --> down_read(&nh->rwsem); <-- held rwsem --> notifier_call_chain() --> lineinfo_changed_notify() --> test_bit(xxxx, cdev->watched_lines) <-- use after free The side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway. To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.
02 / AFFECTED SOFTWARE
Affected packages
26 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
13 explicit affected versions
1 explicit affected versions
10 explicit affected versions
11 explicit affected versions
43 explicit affected versions
59 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
61 explicit affected versions
19 explicit affected versions
6 explicit affected versions
69 explicit affected versions
8 explicit affected versions
54 explicit affected versions
62 explicit affected versions
55 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
7 explicit affected versions
60 explicit affected versions
2 explicit affected versions
13 explicit affected versions
4 explicit affected versions
11 explicit affected versions
35 explicit affected versions
21 explicit affected versions
19 explicit affected versions
18 explicit affected versions
20 explicit affected versions
64 explicit affected versions
7 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
9 explicit affected versions
7 explicit affected versions
12 explicit affected versions
52 explicit affected versions
12 explicit affected versions
14 explicit affected versions
7 explicit affected versions
12 explicit affected versions
12 explicit affected versions
2 explicit affected versions
15 explicit affected versions
3 explicit affected versions
37 explicit affected versions
26 explicit affected versions
13 explicit affected versions
12 explicit affected versions
29 explicit affected versions
13 explicit affected versions
66 explicit affected versions
1 explicit affected versions
2 explicit affected versions
61 explicit affected versions
24 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
1 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
52 explicit affected versions
46 explicit affected versions
62 explicit affected versions
10 explicit affected versions
13 explicit affected versions
26 explicit affected versions
9 explicit affected versions
1 explicit affected versions
2 explicit affected versions
10 explicit affected versions
9 explicit affected versions
16 explicit affected versions
63 explicit affected versions
10 explicit affected versions
8 explicit affected versions
53 explicit affected versions
3 explicit affected versions
2 explicit affected versions
51 explicit affected versions
7 explicit affected versions
10 explicit affected versions
12 explicit affected versions
49 explicit affected versions
27 explicit affected versions
36 explicit affected versions
3 explicit affected versions
6 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
54 explicit affected versions
12 explicit affected versions
15 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
10 explicit affected versions
14 explicit affected versions
38 explicit affected versions
53 explicit affected versions
9 explicit affected versions
13 explicit affected versions
51 explicit affected versions
11 explicit affected versions
2 explicit affected versions
62 explicit affected versions
7 explicit affected versions
33 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
60 explicit affected versions
43 explicit affected versions
10 explicit affected versions
8 explicit affected versions
5 explicit affected versions
14 explicit affected versions
4 explicit affected versions
11 explicit affected versions
1 explicit affected versions
3 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines. Here is the typical stack when issue happened: [free] gpio_chrdev_release() --> bitmap_free(cdev->watched_lines) <-- freed --> blocking_notifier_chain_unregister() --> down_write(&nh->rwsem) <-- waiting rwsem --> __down_write_common() --> rwsem_down_write_slowpath() --> schedule_preempt_disabled() --> schedule() [use] st54spi_gpio_dev_release() --> gpio_free() --> gpiod_free() --> gpiod_free_commit() --> gpiod_line_state_notify() --> blocking_notifier_call_chain() --> down_read(&nh->rwsem); <-- held rwsem --> notifier_call_chain() --> lineinfo_changed_notify() --> test_bit(xxxx, cdev->watched_lines) <-- use after free The side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway. To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/02f6b0e1ec7e0e7d059dddc893645816552039da
- https://git.kernel.org/stable/c/02f6b0e1ec7e0e7d059dddc893645816552039da
- https://git.kernel.org/stable/c/95ca7c90eaf5ea8a8460536535101e3e81160e2a
- https://git.kernel.org/stable/c/ca710b5f40b8b16fdcad50bebd47f50e4c62d239
- https://ubuntu.com/security/CVE-2024-36899
- https://ubuntu.com/security/notices/USN-6949-1
- https://ubuntu.com/security/notices/USN-6949-2
- https://ubuntu.com/security/notices/USN-6952-1
- https://ubuntu.com/security/notices/USN-6952-2
- https://ubuntu.com/security/notices/USN-6955-1
- https://ubuntu.com/security/notices/USN-7387-1
- https://ubuntu.com/security/notices/USN-7387-2
- https://ubuntu.com/security/notices/USN-7387-3
- https://ubuntu.com/security/notices/USN-7388-1
- https://ubuntu.com/security/notices/USN-7389-1
- https://ubuntu.com/security/notices/USN-7390-1
- https://ubuntu.com/security/notices/USN-7407-1
- https://ubuntu.com/security/notices/USN-7421-1
- https://ubuntu.com/security/notices/USN-7458-1
- https://ubuntu.com/security/notices/USN-7459-1
- https://ubuntu.com/security/notices/USN-7459-2
- https://www.cve.org/CVERecord?id=CVE-2024-36899