Linux Kernel PPP Control Protocol Timer Synchronization Vulnerability Leading to Use-After-Free

A use-after-free vulnerability has been identified in the Linux kernel's handling of PPP control protocols (LCP, IPCP, IPV6CP). Each protocol registers a timer, but the corresponding state is not properly synchronized before being freed, particularly during protocol teardown. This oversight allows a timer callback to access freed memory, creating a use-after-free condition. The vulnerability arises because the PPP protocol does not register a detach callback, leaving timer synchronization unaddressed during critical transitions. The issue has been resolved by introducing a detach helper that synchronizes timers before freeing the associated state, ensuring proper memory management and preventing exploitation.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, where a timer callback accesses memory that has already been freed. This can potentially be exploited to execute arbitrary code or cause a denial-of-service condition by disrupting normal kernel operations.

Reproduction

The vulnerability can be reproduced by attaching a PPP control protocol to a device without bringing the device up, which leaves the protocol's timer uninitialized. Then, during the protocol's teardown process, the lack of a registered detach callback allows the timer to access freed memory, creating a use-after-free condition. This can be automated with a script that attaches a PPP protocol, skips the device initialization, and then triggers the teardown process.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading can be found in the official Linux kernel documentation.