{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-39479", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-25T14:23:23.746Z", "datePublished": "2024-07-05T06:55:08.597Z", "dateUpdated": "2026-08-05T11:33:32.923Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:32.923Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hwmon: Get rid of devm\n\nWhen both hwmon and hwmon drvdata (on which hwmon depends) are device\nmanaged resources, the expectation, on device unbind, is that hwmon will be\nreleased before drvdata. However, in i915 there are two separate code\npaths, which both release either drvdata or hwmon and either can be\nreleased before the other. These code paths (for device unbind) are as\nfollows (see also the bug referenced below):\n\nCall Trace:\nrelease_nodes+0x11/0x70\ndevres_release_group+0xb2/0x110\ncomponent_unbind_all+0x8d/0xa0\ncomponent_del+0xa5/0x140\nintel_pxp_tee_component_fini+0x29/0x40 [i915]\nintel_pxp_fini+0x33/0x80 [i915]\ni915_driver_remove+0x4c/0x120 [i915]\ni915_pci_remove+0x19/0x30 [i915]\npci_device_remove+0x32/0xa0\ndevice_release_driver_internal+0x19c/0x200\nunbind_store+0x9c/0xb0\n\nand\n\nCall Trace:\nrelease_nodes+0x11/0x70\ndevres_release_all+0x8a/0xc0\ndevice_unbind_cleanup+0x9/0x70\ndevice_release_driver_internal+0x1c1/0x200\nunbind_store+0x9c/0xb0\n\nThis means that in i915, if use devm, we cannot gurantee that hwmon will\nalways be released before drvdata. Which means that we have a uaf if hwmon\nsysfs is accessed when drvdata has been released but hwmon hasn't.\n\nThe only way out of this seems to be do get rid of devm_ and release/free\neverything explicitly during device unbind.\n\nv2: Change commit message and other minor code changes\nv3: Cleanup from i915_hwmon_register on error (Armin Wolf)\nv4: Eliminate potential static analyzer warning (Rodrigo)\n Eliminate fetch_and_zero (Jani)\nv5: Restore previous logic for ddat_gt->hwmon_dev error return (Andi)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached by reading an i915 hwmon sysfs attribute (`/sys/class/hwmon/hwmonN/energy1_input`) on the local machine; no network or remote peer data is involved, and the heap grooming needed to weaponize the UAF also requires local execution.\nAC:L - The freed-object window is opened only by driver unbind, module removal, or PCI hot-remove — an administrative event an unprivileged attacker cannot cause — but once it occurs the attacker does not need to win a tight timing race: the hwmon sysfs nodes stay registered and readable across the entire teardown interval, so a zero-cost busy-read loop lands in the window deterministically. Choosing the higher-severity option where the two readings are defensible.\nPR:L - `energy1_input`, `in0_input` and `power1_rated_max` are mode 0444 and `power1_max_interval` is 0664, so any local unprivileged account can open and read them with no capability check anywhere on the path from `sysfs_kf_seq_show` down to `hwm_energy()`.\nUI:N - The attacker's read requires no victim action — no file must be opened on the victim's behalf, no media mounted; the driver unbind is a system/administrative event already accounted for in Attack Complexity, not exploit-time user participation.\nS:U - The use-after-free corrupts kernel heap memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a ~400-byte `kmalloc-512` object: `hwmon->rg.energy_status_*` and `rg.pkg_rapl_limit` are read from freed memory and used as MMIO offsets, and `ddat->uncore` is a fully dereferenced stale pointer, so an attacker who reclaims the slot with controlled data obtains an arbitrary kernel/MMIO read reflected back through sysfs.\nI:H - `hwm_energy()` writes into the freed object (`ei->accum_energy`, `ei->reg_val_prev`, and `mutex_lock(&hwmon->hwmon_lock)`), and `intel_uncore_read()` performs an indirect call through `uncore->funcs.mmio_readl` loaded out of the freed allocation — a control-flow hijack primitive once the slab is reclaimed with attacker-influenced contents.\nA:H - Even unweaponized, dereferencing the freed `struct i915_hwmon` and the stale `ddat->uncore` function-pointer table oopses the kernel; this is the reported symptom in the referenced Freedesktop bug, and it can be re-triggered on every unbind." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/i915_hwmon.c" ], "versions": [ { "version": "b3b088e28183b84080b7f0a0b8da84ec42b4b0e8", "lessThan": "cfa73607eb21a4ce1d6294a2c5733628897b48a2", "status": "affected", "versionType": "git" }, { "version": "b3b088e28183b84080b7f0a0b8da84ec42b4b0e8", "lessThan": "ce5a22d22db691d14516c3b8fdbf69139eb2ea8f", "status": "affected", "versionType": "git" }, { "version": "b3b088e28183b84080b7f0a0b8da84ec42b4b0e8", "lessThan": "5bc9de065b8bb9b8dd8799ecb4592d0403b54281", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/i915_hwmon.c" ], "versions": [ { "version": "6.2", "status": "affected" }, { "version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.34", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.5", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cfa73607eb21a4ce1d6294a2c5733628897b48a2" }, { "url": "https://git.kernel.org/stable/c/ce5a22d22db691d14516c3b8fdbf69139eb2ea8f" }, { "url": "https://git.kernel.org/stable/c/5bc9de065b8bb9b8dd8799ecb4592d0403b54281" } ], "title": "drm/i915/hwmon: Get rid of devm", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "1da177e4c3f4", "status": "affected", "lessThan": "cfa73607eb21", "versionType": "custom" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "ce5a22d22db6", "versionType": "custom" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "5bc9de065b8b", "versionType": "custom" }, { "version": "6.6.34", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "custom" }, { "version": "6.95", "status": "unaffected", "lessThanOrEqual": "6.10", "versionType": "custom" }, { "version": "6.10-rc1", "status": "unaffected" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-07-05T14:32:43.637731Z", "id": "CVE-2024-39479", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T14:38:39.208Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.833Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/cfa73607eb21a4ce1d6294a2c5733628897b48a2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ce5a22d22db691d14516c3b8fdbf69139eb2ea8f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5bc9de065b8bb9b8dd8799ecb4592d0403b54281", "tags": [ "x_transferred" ] } ] } ] } }