CVE-2024-57926
Published: 19 January 2025
Summary
CVE-2024-57926 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2024-57926 is a use-after-free vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the MediaTek DRM driver (drm/mediatek). The issue arises because the `private->all_drm_private[i]->drm` pointer is not set to NULL when `mtk_drm_bind` returns an error. Although the pointer is assigned during binding (`private->all_drm_private[i]->drm = drm`), the associated `drm` structure is freed by `drm_dev_put` if `mtk_drm_kms_init` fails. This leads to a dangling pointer that is accessed during shutdown via `drm_atomic_helper_shutdown`, as detected by KASAN.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required (AV:L/AC:L/UI:N). Successful exploitation could result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling kernel memory corruption, denial of service such as system crashes during reboot or shutdown, or arbitrary code execution. The bug manifests during kernel restart processes, as evidenced by the KASAN report in the commit message showing a read of size 8 at a freed address in `drm_atomic_helper_shutdown` triggered by task "shutdown/1".
Mitigation involves applying upstream kernel patches from the provided stable commit references, such as https://git.kernel.org/stable/c/078b2ff7da200b7532398e668eef723ad40fb516, https://git.kernel.org/stable/c/36684e9d88a2e2401ae26715a2e217cb4295cea7, and https://git.kernel.org/stable/c/7083b93e9755d60f0c2bcaa9d064308108280534. These commits explicitly set the pointer to NULL on error in `mtk_drm_bind` to prevent the use-after-free during shutdown paths. Security practitioners should update affected Linux kernels, particularly those using MediaTek DRM hardware on versions like 6.13-rc1 or earlier.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53829
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_bind, all private's drm are set…
more
as follows. private->all_drm_private[i]->drm = drm; And drm will be released by drm_dev_put in case mtk_drm_kms_init returns failure. However, the shutdown path still accesses the previous allocated memory in drm_atomic_helper_shutdown. [ 84.874820] watchdog: watchdog0: watchdog did not stop! [ 86.512054] ================================================================== [ 86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378 [ 86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1 [ 86.515213] [ 86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55 [ 86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022 [ 86.517960] Call trace: [ 86.518333] show_stack+0x20/0x38 (C) [ 86.518891] dump_stack_lvl+0x90/0xd0 [ 86.519443] print_report+0xf8/0x5b0 [ 86.519985] kasan_report+0xb4/0x100 [ 86.520526] __asan_report_load8_noabort+0x20/0x30 [ 86.521240] drm_atomic_helper_shutdown+0x33c/0x378 [ 86.521966] mtk_drm_shutdown+0x54/0x80 [ 86.522546] platform_shutdown+0x64/0x90 [ 86.523137] device_shutdown+0x260/0x5b8 [ 86.523728] kernel_restart+0x78/0xf0 [ 86.524282] __do_sys_reboot+0x258/0x2f0 [ 86.524871] __arm64_sys_reboot+0x90/0xd8 [ 86.525473] invoke_syscall+0x74/0x268 [ 86.526041] el0_svc_common.constprop.0+0xb0/0x240 [ 86.526751] do_el0_svc+0x4c/0x70 [ 86.527251] el0_svc+0x4c/0xc0 [ 86.527719] el0t_64_sync_handler+0x144/0x168 [ 86.528367] el0t_64_sync+0x198/0x1a0 [ 86.528920] [ 86.529157] The buggy address belongs to the physical page: [ 86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc [ 86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff) [ 86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000 [ 86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000 [ 86.534511] page dumped because: kasan: bad access detected [ 86.535323] [ 86.535559] Memory state around the buggy address: [ 86.536265] ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.537314] ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.538363] >ffff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.544733] ^ [ 86.551057] ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.557510] ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.563928] ================================================================== [ 86.571093] Disabling lock debugging due to kernel taint [ 86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b [ 86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f] ...
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in DRM driver directly enables privilege escalation via arbitrary code execution (T1068) and system crashes/DoS during shutdown (T1499).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-57926 by requiring identification, reporting, and correction of the use-after-free flaw via upstream kernel patches that null the dangling pointer on error.
Implements kernel memory protections like KASLR and non-executable memory that reduce the exploitability of use-after-free vulnerabilities in the MediaTek DRM driver.
Facilitates detection of kernel vulnerabilities like CVE-2024-57926 through automated scanning, enabling timely flaw remediation before exploitation during shutdown.