CVE-2024-53194

Summary

CVE-2024-53194 is a vulnerability affecting the Linux kernel that results in a use-after-free issue. This problem occurs when the PCI Host Controller (pciehp) is unbound from a Downstream Port before the corresponding pci_bus is destroyed, leading to a use-after-free error in pci_slot_release(). The issue was discovered when a Lenovo laptop with a USB4 dock experienced a boot crash. The PCI core uses a two-step process to remove a portion of the hierarchy, but there is no precaution to prevent driver binding between pci_stop_bus_device() and pci_remove_bus_device(). To mitigate this vulnerability, pci_slot should acquire a reference to the pci_bus before accessing it to avoid use-after-free scenarios. The reported crash was resolved after making this modification.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.