CVE-2024-56652
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
27/12/2024
Last modified:
11/02/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/xe/reg_sr: Remove register pool<br />
<br />
That pool implementation doesn&#39;t really work: if the krealloc happens to<br />
move the memory and return another address, the entries in the xarray<br />
become invalid, leading to use-after-free later:<br />
<br />
BUG: KASAN: slab-use-after-free in xe_reg_sr_apply_mmio+0x570/0x760 [xe]<br />
Read of size 4 at addr ffff8881244b2590 by task modprobe/2753<br />
<br />
Allocated by task 2753:<br />
kasan_save_stack+0x39/0x70<br />
kasan_save_track+0x14/0x40<br />
kasan_save_alloc_info+0x37/0x60<br />
__kasan_kmalloc+0xc3/0xd0<br />
__kmalloc_node_track_caller_noprof+0x200/0x6d0<br />
krealloc_noprof+0x229/0x380<br />
<br />
Simplify the code to fix the bug. A better pooling strategy may be added<br />
back later if needed.<br />
<br />
(cherry picked from commit e5283bd4dfecbd3335f43b62a68e24dae23f59e4)
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.8 (including) | 6.12.6 (excluding) |
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page