SB2025011759 - Use-after-free in Linux kernel spi driver
Published: January 17, 2025 Updated: May 11, 2025
Security Bulletin ID
SB2025011759
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2024-50051)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the mpc52xx_spi_remove() function in drivers/spi/spi-mpc52xx.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/373d55a47dc662e5e30d12ad5d334312f757c1f1
- https://git.kernel.org/stable/c/90b72189de2cddacb26250579da0510b29a8b82b
- https://git.kernel.org/stable/c/984836621aad98802d92c4a3047114cf518074c8
- https://git.kernel.org/stable/c/cd5106c77d6d6828aa82449f01f4eb436d602a21
- https://git.kernel.org/stable/c/d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1
- https://git.kernel.org/stable/c/e0c6ce8424095c2da32a063d3fc027494c689817
- https://git.kernel.org/stable/c/f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.66