CVE-2024-50051
Published: 11 January 2025
Summary
CVE-2024-50051 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2024-50051 is a use-after-free (UAF) vulnerability in the Linux kernel's mpc52xx SPI driver. The issue arises during module removal via mpc52xx_spi_remove, where the 'ms' structure is freed through spi_unregister_controller, but the associated work item ms->work may still be executed afterward, leading to a UAF condition. This affects systems running vulnerable versions of the Linux kernel that include the mpc52xx SPI driver, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-416.
A local attacker with low privileges can exploit this vulnerability by triggering the module removal sequence, potentially causing the UAF to occur. Successful exploitation could allow the attacker to achieve high-impact confidentiality, integrity, and availability effects, such as arbitrary code execution, data corruption, or system crashes, depending on the timing and context of the work item execution.
The provided kernel patch references detail the mitigation, which involves adding cancel_work_sync() in mpc52xx_spi_remove to ensure the work item is canceled before cleanup proceeds, preventing the UAF. Security practitioners should apply the stable kernel commits (e.g., 373d55a47dc6, 90b72189de2c) to affected systems.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44765
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The…
more
sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
UAF in kernel driver enables local arbitrary code execution for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, prioritization, and remediation of flaws such as the UAF in the mpc52xx SPI driver during module removal by applying the provided kernel patches.
Implements memory protection mechanisms that restrict unauthorized access and mitigate exploitation of the use-after-free vulnerability in the kernel driver.
Requires secure kernel configuration settings to disable unnecessary modules like mpc52xx_spi, preventing loading and unloading of the vulnerable driver.