Loading vulnerability…
Use-after-free in Linux kernel PPS device unregistration
CVE-2024-57979 is a use-after-free vulnerability in the Linux kernel Pulse Per Second (PPS) subsystem. During source unregistration, pps_device_destruct() frees a pps_device and its embedded character device immediately after cdev_del(), although references and file operations associated with previously opened character devices can remain usable. Subsequent file cleanup can access the freed character-device object. The flaw was reproduced during gpsd process exit on reboot, causing reference-count underflow, memory corruption, kernel BUGs, and kernel panic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Stale character-device references can cause invalid kobject accesses, reference-count underflow, and kernel memory corruption. Observed consequences include kernel BUGs and fatal kernel panic, resulting in system-wide denial of service. Although the published CVSS assessment assigns high confidentiality, integrity, and availability impacts, privilege escalation, information disclosure, and arbitrary code execution are not demonstrated.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Pending patching, restrict local access and PPS-device access to trusted users and services. For affected Siemens additional GNU/Linux subsystems, restrict interactive shell access to trusted personnel and run applications only from trusted sources. These measures reduce exposure but do not correct the device-lifetime defect.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the PPS lifetime-management fix and reboot into the updated kernel. The fix removes the embedded cdev, uses __register_chrdev(), makes pps_idr authoritative for minor-to-device lookup, moves idr_remove() into pps_unregister_cdev(), and ensures pps_idr retains a reference to pps->dev while userspace can discover the device. Fixed packages include RHEL 8 kernel 4.18.0-553.44.1.el8_10 and kernel-rt 4.18.0-553.44.1.rt7.385.el8_10, and Google COS lakitu-kernel-6_6 version 18964.0.0 or later for the applicable release stream. Siemens SIMATIC product advisories identify no fixed firmware in their cited revisions; deploy the applicable Siemens-supported update when available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.