Executive Summary

This vulnerability is a use-after-free bug in the Linux kernel's greybus raw driver. It occurs when a raw bundle is disconnected but its character device (cdev) is still open by an application. When the application later closes the cdev, the system tries to access memory that has already been freed, causing a kernel panic with a refcount underflow warning.

The root cause is that the cdev is part of a structure that gets freed during the disconnect operation, but the cdev can still be referenced afterward. The fix involves embedding the device structure within the cdev structure to synchronize their lifetimes, using cdev_device_add to manage device references properly, and deferring freeing the structure until the device release function is called.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel panic, leading to system crashes or instability when an application closes a character device after its underlying raw bundle has been disconnected. This can result in denial of service or unexpected system behavior.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a use-after-free bug in the Linux kernel greybus raw driver, which can cause a kernel panic with messages such as "refcount_t: underflow; use-after-free" and warnings from refcount_warn_saturate.

Detection can be done by monitoring kernel logs for these specific panic messages and call traces related to cdev_put, __fput, and __x64_sys_close.

Commands to check kernel logs include:

• dmesg | grep -i 'refcount_t: underflow'
• journalctl -k | grep -i 'use-after-free'
• journalctl -k | grep -E 'cdev_put|__fput|__x64_sys_close'

Additionally, enabling CONFIG_INIT_ON_FREE_DEFAULT_ON=y in the kernel configuration can help trigger the panic for easier detection during testing.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the greybus raw driver has been fixed to prevent the use-after-free condition.

The fix involves converting the struct device from a pointer to an embedded structure to synchronize the lifetime of the cdev and device, using cdev_device_add to manage device references properly, and delegating freeing to the device release function.

Until the patch is applied, avoid disconnecting raw bundles while applications still have the chardev open to prevent triggering the bug.

Monitoring for kernel panics related to this issue and restricting usage of affected greybus raw devices can also reduce risk.

Useful 0 Not Useful 0