{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46746", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.266Z", "datePublished": "2024-09-18T07:12:06.910Z", "dateUpdated": "2026-08-05T11:38:19.210Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:19.210Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: free driver_data after destroying hid device\n\nHID driver callbacks aren't called anymore once hid_destroy_device() has\nbeen called. Hence, hid driver_data should be freed only after the\nhid_destroy_device() function returned as driver_data is used in several\ncallbacks.\n\nI observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling\nKASAN to debug memory allocation, I got this output:\n\n [ 13.050438] ==================================================================\n [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]\n [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3\n [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479\n\n [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0\n [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024\n [ 13.067860] Call Trace:\n [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8\n [ 13.071486] \n [ 13.071492] dump_stack_lvl+0x5d/0x80\n [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002)\n [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n [ 13.082199] print_report+0x174/0x505\n [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n [ 13.097464] kasan_report+0xc8/0x150\n [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]\n [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\n [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\n [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0\n [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]\n [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.150446] ? __devm_add_action+0x167/0x1d0\n [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\n [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.161814] platform_probe+0xa2/0x150\n [ 13.165029] really_probe+0x1e3/0x8a0\n [ 13.168243] __driver_probe_device+0x18c/0x370\n [ 13.171500] driver_probe_device+0x4a/0x120\n [ 13.175000] __driver_attach+0x190/0x4a0\n [ 13.178521] ? __pfx___driver_attach+0x10/0x10\n [ 13.181771] bus_for_each_dev+0x106/0x180\n [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10\n [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10\n [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.194382] bus_add_driver+0x29e/0x4d0\n [ 13.197328] driver_register+0x1a5/0x360\n [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\n [ 13.203362] do_one_initcall+0xa7/0x380\n [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10\n [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5\n [ 13.213211] ? kasan_unpoison+0x44/0x70\n [ 13.216688] do_init_module+0x238/0x750\n [ 13.2196\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Both halves are local — the free comes from amd_sfh driver teardown (probe-failure `cleanup:` path or PCI unbind/module unload) and the use comes from `hid_hw_request()` driven through IIO sysfs on the local machine. No network or adjacent-network input reaches `amd_sfh_get_report()`.\nAC:L - An unprivileged process can keep HID callbacks continuously in flight by looping reads of the world-readable `in_*_raw` IIO attributes, and `amdtp_wait_for_response()`'s 1500 ms wait plus `_hid_sensor_power_state()`'s `msleep_interruptible()` leave a multi-millisecond window that is retried at will; reclaiming a 64-byte kmalloc slot from userspace is a standard, reliable spray.\nPR:L - The entire use side — `hid_hw_request()`/`hid_hw_wait()` into `amd_sfh_get_report()`/`amd_sfh_set_report()` — is reachable by any local user through 0444 IIO sysfs attributes, and the free side is hit by the probe-time `amd_sfh_hid_client_init()` cleanup path that runs on its own without any privileged action, so no root or real capability is needed by the attacker.\nUI:N - The attacker drives the HID callbacks and the heap grooming itself; the freeing teardown occurs from driver lifecycle events (probe cleanup, unbind) rather than from any action a victim user must be tricked into performing.\nS:U - The freed `struct amdtp_hid_data` and the objects reached through the stale `cli_data` pointer all belong to the kernel itself, so impact stays inside the kernel's own security authority with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `hid->driver_data` is dereferenced after `kfree()`, so a resprayed kmalloc-64 slot supplies an attacker-chosen `cli_data`, and the subsequent reads of `cli_data->num_hid_devices`, `->sensor_idx[i]`, `->in_data` and `->hid_sensor_hubs[i]` (fed back to userspace via `hid_input_report()` into IIO values) amount to arbitrary kernel memory disclosure.\nI:H - The same controlled `cli_data` yields writes at attacker-chosen addresses — `cli_data->report_id[i] = report_id`, `->request_done[i] = false`, `->cur_hid_dev = i`, and `list_add(&new->list, &req_list->list)` — while `schedule_delayed_work(&cli_data->work, 0)` and `wake_up_interruptible(&hid_data->hid_wait)` operate on freed/forged structures, giving a control-flow hijack primitive.\nA:H - The reported KASAN slab-use-after-free in `amd_sfh_get_report()` is immediately followed by a fatal `Oops: general protection fault, probably for non-canonical address`, so the bug reliably panics the kernel even without full exploitation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/amd-sfh-hid/amd_sfh_hid.c" ], "versions": [ { "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61", "lessThan": "86b4f5cf91ca03c08e3822ac89476a677a780bcc", "status": "affected", "versionType": "git" }, { "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61", "lessThan": "775125c7fe38533aaa4b20769f5b5e62cc1170a0", "status": "affected", "versionType": "git" }, { "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61", "lessThan": "60dc4ee0428d70bcbb41436b6729d29f1cbdfb89", "status": "affected", "versionType": "git" }, { "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61", "lessThan": "adb3e3c1ddb5a23b8b7122ef1913f528d728937c", "status": "affected", "versionType": "git" }, { "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61", "lessThan": "97155021ae17b86985121b33cf8098bcde00d497", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/amd-sfh-hid/amd_sfh_hid.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.110", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.51", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.10.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/86b4f5cf91ca03c08e3822ac89476a677a780bcc" }, { "url": "https://git.kernel.org/stable/c/775125c7fe38533aaa4b20769f5b5e62cc1170a0" }, { "url": "https://git.kernel.org/stable/c/60dc4ee0428d70bcbb41436b6729d29f1cbdfb89" }, { "url": "https://git.kernel.org/stable/c/adb3e3c1ddb5a23b8b7122ef1913f528d728937c" }, { "url": "https://git.kernel.org/stable/c/97155021ae17b86985121b33cf8098bcde00d497" } ], "title": "HID: amd_sfh: free driver_data after destroying hid device", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T14:48:56.187128Z", "id": "CVE-2024-46746", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:49:10.199Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:17:39.964Z" } } ] } }