Use-after-free Vulnerability in Linux Kernel Affecting NTPD and GPSD on Raspberry Pi

CVE-2024-57979

Summary

A critical use-after-free vulnerability exists in the Linux kernel when handling the PPS (Pulse Per Second) device, specifically within the context of NTPD and GPSD services. The vulnerability can lead to kernel panics and undefined behavior on affected hardware such as the Raspberry Pi 4 Model B during system reboots. This occurs due to improper management of device lifecycle and reference counting, allowing access to freed memory. The issue was highlighted by a sequence of warnings and call trace outputs pointing to invalid operations post device removal, demonstrating the need for careful resource management in kernel development.

References