Use-After-Free in Linux Kernel MTK Power Domain Driver

Impact Analysis

This vulnerability is a use-after-free issue in the Linux kernel's mediatek pmdomain driver. It can lead to the kernel dereferencing freed memory, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's mediatek pmdomain component, specifically in the function scpsys_get_bus_protection_legacy().

The problem occurs because the function of_find_node_with_property() returns a device node with its reference count incremented, but the code calls of_node_put(node) too early, before checking if syscon_regmap_lookup_by_phandle() returns an error.

If an error occurs, the code attempts to dereference the node pointer to print diagnostic information using dev_err_probe(), but since the node memory may have already been freed due to the earlier of_node_put() call, this leads to a use-after-free vulnerability.

The fix involves moving the of_node_put() call after the error check to ensure the node is still valid when accessed in the error path.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the issue in scpsys_get_bus_protection_legacy() has been fixed. The fix involves moving the of_node_put() call after the error check to prevent use-after-free.

Until the kernel is updated, avoid running untrusted code that could trigger this vulnerability and monitor for any suspicious behavior related to device node handling in the mediatek platform.

Useful 0 Not Useful 0