CVE-2024-49924

In the Linux kernel, the following vulnerability has been resolved:

fbdev: pxafb: Fix possible use after free in pxafb_task()

In the pxafb_probe function, it calls the pxafb_init_fbinfo function,

after which &fbi->task is associated with pxafb_task. Moreover,

within this pxafb_init_fbinfo function, the pxafb_blank function

within the &pxafb_ops struct is capable of scheduling work.

If we remove the module which will call pxafb_remove to make cleanup,

it will call unregister_framebuffer function which can call

do_unregister_framebuffer to free fbi->fb through

put_fb_info(fb_info), while the work mentioned above will be used.

The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

| pxafb_task

pxafb_remove |

unregister_framebuffer(info) |

do_unregister_framebuffer(fb_info) |

put_fb_info(fb_info) |

// free fbi->fb | set_ctrlr_state(fbi, state)

| __pxafb_lcd_power(fbi, 0)

| fbi->lcd_power(on, &fbi->fb.var)

| //use fbi->fb

Fix it by ensuring that the work is canceled before proceeding

with the cleanup in pxafb_remove.

Note that only root user can remove the driver at runtime.