CVE-2024-57979: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in the Linux kernel's PPS (Pulse Per Second) subsystem. The issue occurs when gpsd is running and the system is rebooting, causing a use-after-free condition in sys_exit() when pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(). The vulnerability was assigned CVE-2024-57979 and affects the Linux kernel PPS subsystem (NVD, RedHat).

The vulnerability stems from a race condition where fops for previously opened cdevs are still callable even after cdev_del() returns. The issue manifests when pps_device_destruct() frees the pps_device structure containing the embedded cdev immediately after calling cdev_del(). This leads to a use-after-free condition that can trigger kernel panics. The CVSS v3.1 base score is 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (RedHat).

The vulnerability can lead to kernel panics and system crashes when exploited. The use-after-free condition can potentially be leveraged for arbitrary code execution in kernel context, with impacts including system crashes, information disclosure, and potential privilege escalation (RedHat).

The vulnerability requires local access and can be triggered reliably when running ntpd and gpsd during system reboot. The issue has been confirmed to be consistently reproducible on affected systems, particularly on Raspberry Pi 4 hardware running the vulnerable kernel versions (Kernel Commit).

The vulnerability has been fixed by removing the embedded cdev and using __register_chrdev() with pps_idr as the source of truth for minor device mapping. The fix ensures the pps->dev refcount cannot reach zero while userspace can still access it. System administrators should apply the kernel updates provided by their distribution vendors (RedHat).