Bug 2320195 (CVE-2024-47732) - CVE-2024-47732 kernel: crypto: iaa - Fix potential use after free bug
Summary: CVE-2024-47732 kernel: crypto: iaa - Fix potential use after free bug
Keywords:
Status: NEW
Alias: CVE-2024-47732
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2320344
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-21 13:01 UTC by OSIDB Bzimport
Modified: 2024-12-20 15:15 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-10-21 13:01:15 UTC
In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees
"device_mode" but it iss passed to iaa_compression_modes[i]->free() a few
lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the
->free() function and the use after free happens in dead code.  But, with
this fix, when something does implement it, we'll be ready.  :)

Comment 2 Borja Tarraso 2024-12-20 09:58:05 UTC
This code is not reachable since it is not call anywhere as shown in the description of the issue from the kernel mailing list As well as the three commits where the issue has been fixed:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c66f0be993ba52410edab06124c54ecf143b05c1
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209

For being in the safe side, in case we missed this function call at any given time from the moment which was introduced in 6.8 via b5d534b473e2 commit until has been fixed in 6.10.13, 6.11.2 and 6.12-rc1, in any possible forked code, or exploited via another buffer overflow, we would keep this as low probability flaw which most likely would never happen.


Note You need to log in before you can comment on or make changes to this bug.