{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-49925",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-49925"
  ],
  "published": "2024-10-21T18:02:47Z",
  "summary": "fbdev: efifb: Register sysfs groups through driver core",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: efifb: Register sysfs groups through driver core\n\nThe driver core can register and cleanup sysfs groups already.\nMake use of that functionality to simplify the error handling and\ncleanup.\n\nAlso avoid a UAF race during unregistering where the sysctl attributes\nwere usable after the info struct was freed.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49925"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2d97b85eb5a86766ad0f8ea3d121e6ae144e3ed8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2a9c40c72097b583b23aeb2a26d429ccfc81fbc1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/36bfefb6baaa8e46de44f4fd919ce4347337620f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/872cd2d029d2c970a8a1eea88b48dab2b3f2e93a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4684d69b9670a83992189f6271dc0fcdec4ed0d7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/95cdd538e0e5677efbdf8aade04ec098ab98f457"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is reached only by reading sysfs files under /sys/devices/platform/efi-framebuffer.0/ from a local process; there is no network, adjacent-network, or remote-peer path into efifb's attribute show handlers.\nAC:L - Exploitation requires the system to be in the narrow state of tearing down the efifb platform driver \u2014 a state only root can induce (driver unbind, or a DRM driver load calling aperture_remove_conflicting_devices()) \u2014 and the window between unregister_framebuffer() and sysfs_remove_groups() is a handful of instructions. The attacker controls only the reader side of the race and cannot trigger, widen, or retry the free.\nPR:L - The attributes are DEVICE_ATTR_RO (mode 0444), so any unprivileged local user, including one inside a container with /sys mounted, can read them in a tight loop with no capability at all.\nUI:N - The driver-removal event that opens the window is an automatic boot-time DRM handoff on typical systems rather than a deliberate victim action, and the attacker's own read requires no interaction from anyone else.\nS:U - The stale attribute access and the freed struct fb_info both live in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A successful read in the window dereferences the freed struct fb_info allocation, and because the read is repeatable and the attacker can spray the slab between attempts to control what lands in the freed slot, it acts as a kernel-heap disclosure oracle rather than a single bounded leak.\nI:N - Every attribute in efifb_groups is DEVICE_ATTR_RO with no store() method, so the code path performs only loads \u2014 there is no out-of-bounds write, no write into the freed object, and no way to alter kernel memory or control flow.\nA:H - Touching the freed fb_info can fault and oops when the backing page has been returned to the allocator or on hardened builds (KASAN/KFENCE/DEBUG_PAGEALLOC), and any such fault in the fbdev teardown path takes down the kernel."
    }
  }
}