Linux Kernel OMAP2 fbdev Subsystem Use-After-Free Vulnerability in Memory Mapping

A use-after-free vulnerability has been identified in the Linux kernel's OMAP2 framebuffer (fbdev) subsystem. This issue arises in the 'omapfb_mmap()' function, which handles memory mapping for framebuffer regions. The vulnerability is caused by a race condition between the 'omapfb_mmap()' function and the 'OMAPFB_SETUP_PLANE' ioctl handler. While 'omapfb_mmap()' holds the memory management lock, it does not hold the framebuffer info lock, allowing concurrent execution that can lead to memory safety issues. The vulnerability can be reproduced by mapping a framebuffer region while simultaneously issuing an ioctl command that modifies the region's metadata. This creates a scenario where the mapped memory can be freed while still in use, leaving a dangling pointer that can be exploited to access freed physical memory.

Impact

Exploitation of this vulnerability can result in a use-after-free condition, where userspace retains a mapping to physical memory that has already been freed. This can lead to memory corruption or unauthorized access to sensitive data.

Reproduction

The vulnerability can be reproduced by invoking the 'omapfb_mmap()' function to map a framebuffer region. While this mapping is active, send an 'OMAPFB_SETUP_PLANE' ioctl command to the same framebuffer. This ioctl will update the framebuffer's region reference and metadata, creating a race condition that the 'omapfb_mmap()' function does not account for. As a result, the old memory region can be freed while still mapped, leading to a use-after-free vulnerability.

Remediation

The vulnerability has been fixed by modifying the 'omapfb_mmap()' function to read all necessary values from the same memory region reference, ensuring that the reference count is properly managed. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.