Linux Kernel rpmsg Character Device Endpoint Priv Pointer Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's rpmsg character device handling. When the rpmsg_chrdev_probe() function is called, it stores a pointer to a newly allocated endpoint device (eptdev) in the default endpoint's private data. If the subsequent call to rpmsg_chrdev_eptdev_add() fails, the eptdev is freed, but the default endpoint may still attempt to use the stale pointer, leading to potential memory corruption. This vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can lead to memory corruption due to the use of a freed pointer, which may cause undefined behavior in the kernel.

Reproduction

To reproduce this vulnerability, load a rpmsg character device endpoint and trigger a failure in the rpmsg_chrdev_eptdev_add() function. This will cause the endpoint device pointer to be freed while the default endpoint still holds a reference to it, allowing for callbacks to be dispatched with a stale pointer.

Remediation

Users can upgrade to the latest patched version of the Linux kernel stable tree, where this vulnerability has been addressed.