fbdev: pxafb: Fix possible use after free in pxafb_task()

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2024-49924
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-10-21 18:15:14 UTC
Updated2026-05-28 15:12:23 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-416

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Debian Debian Linux 11.0 All All All
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 6d0a07f68b66269e167def6c0b90a219cd3e7473 git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 e6897e299f57b103e999e62010b88e363b3eebae git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 4cda484e584be34d55ee17436ebf7ad11922b97a git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 3c0d416eb4bef705f699213cee94bf54b6acdacd git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 fdda354f60a576d52dcf90351254714681df4370 git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 aaadc0cb05c999ccd8898a03298b7e5c31509b08 git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 a3a855764dbacbdb1cc51e15dc588f2d21c93e0e git Not specified
CNA Linux Linux affected 9f17f2874834f4cdbe48cc05676d8f7558793204 4a6921095eb04a900e0000da83d9475eb958e61e git Not specified
CNA Linux Linux affected 2.6.27 Not specified
CNA Linux Linux unaffected 2.6.27 semver Not specified
CNA Linux Linux unaffected 4.19.323 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.285 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.227 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.168 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.113 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.55 6.6.* semver Not specified
CNA Linux Linux unaffected 6.10.14 6.10.* semver Not specified
CNA Linux Linux unaffected 6.11.3 6.11.* semver Not specified
CNA Linux Linux unaffected 6.12 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/aaadc0cb05c999ccd8898a03298b7e5c31509b08 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/a3a855764dbacbdb1cc51e15dc588f2d21c93e0e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/6d0a07f68b66269e167def6c0b90a219cd3e7473 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/e6897e299f57b103e999e62010b88e363b3eebae 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/4a6921095eb04a900e0000da83d9475eb958e61e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/fdda354f60a576d52dcf90351254714681df4370 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/3c0d416eb4bef705f699213cee94bf54b6acdacd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/4cda484e584be34d55ee17436ebf7ad11922b97a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/01/msg00001.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report