{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49992", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.054Z", "datePublished": "2024-10-21T18:02:34.442Z", "dateUpdated": "2026-08-05T11:40:57.945Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:57.945Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: Avoid use-after-free issues with crtc and plane\n\nltdc_load() calls functions drm_crtc_init_with_planes(),\ndrm_universal_plane_init() and drm_encoder_init(). These functions\nshould not be called with parameters allocated with devm_kzalloc()\nto avoid use-after-free issues [1].\n\nUse allocations managed by the DRM framework.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n[1]\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable objects are reached through the local DRM character device `/dev/dri/card0` — via modeset ioctls on an already-open fd and via the `close()`-driven `drm_dev_release()` path — with the free triggered by local platform-driver unbind/module removal. There is no network or remote-peer input to the STM32 LTDC display controller.\nAC:L - There is no race to win: once the platform device is unbound, `devres_release_all()` deterministically frees the `drm_crtc`/`drm_plane`/`drm_encoder`/panel-bridge `drm_connector` while the objects remain linked in `mode_config`'s lists and `object_idr`, and the attacker alone decides when to spray the general-purpose kmalloc slab and when to close the fd that runs `drm_mode_config_cleanup()` on the freed memory. No attacker-uninfluenceable memory layout or system state is required.\nPR:L - Every step the attacker performs needs only an ordinary local account with access to the DRM node — `DRM_IOCTL_MODE_GETRESOURCES`/`GETCRTC`/`GETPLANE`/`GETCONNECTOR` are registered with flags `0` (no `DRM_MASTER`, no `DRM_AUTH`, no capability check), and the `close()` path that dereferences the freed objects checks nothing at all. The freeing event is a routine system operation (driver unbind or `stm-drm` module reload during an update), not an additional privilege the attacker must hold; they merely keep the fd open across it.\nUI:N - The attacker opens the fd, sprays the slab, and closes the fd or issues the GET* ioctls entirely on their own; on single-purpose STM32MP appliances the driver reload happens autonomously as part of normal system operation. No victim must be lured into opening a file, mounting media, or plugging in hardware.\nS:U - The corrupted objects and the hijacked control flow are kernel heap and kernel function pointers on the same host, within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the devres free, unprivileged `MODE_GETRESOURCES`/`GETCRTC`/`GETPLANE`/`GETCONNECTOR` ioctls read the freed `drm_crtc`/`drm_plane`/`drm_connector` slab objects and copy fields out to userspace, disclosing whatever kernel data now occupies those kmalloc buckets. Combined with a controlled reclaim this yields a general kernel heap read primitive.\nI:H - `drm_mode_config_cleanup()` performs `encoder->funcs->destroy()`, `plane->funcs->destroy()` and `crtc->funcs->destroy()` by loading a function-pointer table out of the freed allocation, and `drm_mode_object_get/put()` does atomic read-modify-write on the freed objects — giving an attacker who has groomed the slab both an arbitrary-write and a direct control-flow-hijack primitive leading to kernel code execution.\nA:H - Even unexploited, walking `mode_config`'s crtc/plane/encoder/connector lists through freed memory and calling through a stale `funcs` pointer reliably oopses or panics the kernel, and the display teardown path is unrecoverable. The condition is reproducible on every unbind-with-open-fd cycle." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/stm/drv.c", "drivers/gpu/drm/stm/ltdc.c" ], "versions": [ { "version": "b759012c5fa761ee08998c80fc4ad6343c258487", "lessThan": "d02611ff001454358be6910cb926799e2d818716", "status": "affected", "versionType": "git" }, { "version": "b759012c5fa761ee08998c80fc4ad6343c258487", "lessThan": "0a1741d10da29aa84955ef89ae9a03c4b6038657", "status": "affected", "versionType": "git" }, { "version": "b759012c5fa761ee08998c80fc4ad6343c258487", "lessThan": "454e5d7e671946698af0f201e48469e5ddb42851", "status": "affected", "versionType": "git" }, { "version": "b759012c5fa761ee08998c80fc4ad6343c258487", "lessThan": "b22eec4b57d04befa90e8554ede34e6c67257606", "status": "affected", "versionType": "git" }, { "version": "b759012c5fa761ee08998c80fc4ad6343c258487", "lessThan": "19dd9780b7ac673be95bf6fd6892a184c9db611f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/stm/drv.c", "drivers/gpu/drm/stm/ltdc.c" ], "versions": [ { "version": "4.13", "status": "affected" }, { "version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d02611ff001454358be6910cb926799e2d818716" }, { "url": "https://git.kernel.org/stable/c/0a1741d10da29aa84955ef89ae9a03c4b6038657" }, { "url": "https://git.kernel.org/stable/c/454e5d7e671946698af0f201e48469e5ddb42851" }, { "url": "https://git.kernel.org/stable/c/b22eec4b57d04befa90e8554ede34e6c67257606" }, { "url": "https://git.kernel.org/stable/c/19dd9780b7ac673be95bf6fd6892a184c9db611f" } ], "title": "drm/stm: Avoid use-after-free issues with crtc and plane", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-49992", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:31:07.009365Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:38:42.528Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:24:11.293Z" } } ] } }