Look up another CVE · open CVE-2024-57984 in the interactive tracker
CVE-2024-57984
i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
Published 2025-02-27 (20 months ago) by the Linux kernel CNA. Subsystem drivers/i3c. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2024-57984 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.13-1 | Update the kernel and reboot. Fixed in 6.12.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.12.13-1 | Update the kernel and reboot. Fixed in 6.12.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.12.13-1 | Update the kernel and reboot. Fixed in 6.12.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In dw_i3c_common_probe, &master->hj_work is bound with dw_i3c_hj_work. And dw_i3c_master_irq_handler can call dw_i3c_master_irq_handle_ibis function to start the work. If we remove the module which will call dw_i3c_common_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | dw_i3c_hj_work dw_i3c_common_remove | i3c_master_unregister(&master->base) | device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in dw_i3c_common_remove.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/i3c/master/dw-i3c-master.c
- What this is
- I3C DRIVER FOR SYNOPSYS DESIGNWAREMAINTAINERS section matched on drivers/i3c/master/dw* · Orphan
- Kernel module
- none to look for. The file would have gone into dw_i3c_master, and Debian does not compile it into that module, so finding dw_i3c_master in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_DW_I3C_MASTER|CONFIG_I3C' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_DW_I3C_MASTER, CONFIG_I3C
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-02-27 (20 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.23%, higher than 13.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/i3c
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.0 | 6.6.76 | 60d2fb033a99 |
| 5.0 | 6.12.13 | 9b0063098fcd |
| 5.0 | 6.13.2 | fc84dd3c909a |
| 5.0 | 6.14 | b75439c945b9 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The attacker-controlled side of the race is driver teardown, reached locally via module unload or a write to the platform driver's sysfs unbind attribute, and the hot-join IBI side originates on the on-board I3C bus. No network or remote protocol path reaches this code, so the entry point is local system access.
- AC:LAttack complexity, low
- The attacker directly controls the teardown side of the race and can repeat bind/unbind cycles indefinitely until the pending hj_work collides with i3c_master_unregister(), so success does not depend on conditions outside their influence. Hot-Join IBIs recur on any bus where hot-join is enabled, giving the attacker repeated windows.
- PR:LPrivileges required, low
- A basic local account is sufficient to reach the i3c sysfs surface and drive the device teardown/re-probe cycling that opens the race window, and no capability check gates the vulnerable hj_work path itself. Consistent with the scoring of equivalent driver remove-path work-item UAFs, low privileges are the defensible assumption.
- UI:NUser interaction, none
- The attacker performs the removal and the Hot-Join IBI is delivered by hardware on the bus; no victim action, mount, or file open is required. Exploitation completes entirely from the attacker's own operations.
- S:UScope, unchanged
- The use-after-free corrupts kernel heap state within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary. Impact is confined to the kernel that owns the vulnerable driver.
- C:HConfidentiality impact, high
- The freed dw_i3c_master object is read back by i3c_master_do_daa(), including its ops pointer and device table, so an attacker who reclaims the allocation gains control over interpreted kernel memory and can leverage it for arbitrary kernel memory disclosure. Per use-after-free scoring guidance this is High.
- I:HIntegrity impact, high
- i3c_master_do_daa() calls master->ops->do_daa(master) — an indirect branch through a function pointer read from freed memory — and i3c_master_register_new_i3c_devs() then mutates torn-down bus lists, providing both control-flow hijack and write primitives after heap spraying. This is full integrity compromise.
- A:HAvailability impact, high
- Even without successful exploitation the work dereferences freed memory and performs readl/writel against MMIO already unmapped by devres, producing a kernel oops or panic. Any use-after-free of this kind is a reliable crash.