{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-53165",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-53165"
  ],
  "published": "2024-12-27T13:53:01Z",
  "summary": "sh: intc: Fix use-after-free bug in register_intc_controller()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: intc: Fix use-after-free bug in register_intc_controller()\n\nIn the error handling for this function, d is freed without ever\nremoving it from intc_list which would lead to a use after free.\nTo fix this, let's only add it to the list after everything has\nsucceeded.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53165"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3c7c806b3eafd94ae0f77305a174d63b69ec187c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d8de818df12d86a1a26a8efd7b4b3b9c6dc3c5cc"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/971b4893457788e0e123ea552f0bb126a5300e61"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c3f4f4547fb291982f5ef56c048277c4d5ccc4e4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c43df7dae28fb9fce96ef088250c1e3c3a77c527"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b8b84dcdf3ab1d414304819f824b10efba64132c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6ba6e19912570b2ad68298be0be1dc779014a303"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/588bdec1ff8b81517dbae0ae51c9df52c0b952d3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/63e72e551942642c48456a4134975136cdcb9b3c"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.4,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - `register_intc_controller()` is SuperH platform interrupt-controller boot code with no network, packet, or remote-peer input; the only user-visible surface tied to the freed object is the local sysfs attribute `/sys/devices/system/intc/intc.N/name` and local suspend/resume activity, so exposure is confined to the local system.\nAC:H - The dangling list entry is created only when a `GFP_NOWAIT`/`kcalloc` allocation or `ioremap()` fails inside an `__init` function during early boot, before userspace exists, so the triggering memory-pressure condition is entirely outside any attacker's influence, and it additionally requires SuperH hardware with `CONFIG_SH_INTC`.\nPR:N - No privileges or credentials are involved at any point \u2014 the freed `intc_desc_int` is dereferenced by the kernel itself at `device_initcall` time (`register_intc_devs()`) long before any login, and the resulting sysfs `name` attribute that reads the freed object is world-readable (`S_IRUGO`).\nUI:N - Once the error path executes, the stale list entry is dereferenced automatically during the remainder of boot and on every subsequent suspend/resume cycle; no victim action is needed.\nS:U - The use-after-free is confined to kernel heap objects managed by the SH interrupt-controller driver; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - The freed `intc_desc_int` is read back after release \u2014 `show_intc_name()` dereferences `d->chip.name` from freed slab memory through a world-readable sysfs file, and list traversal reads `d->list.next` out of reallocated memory, so reclaimed heap contents can be disclosed.\nI:H - `register_intc_devs()` performs `device_register(&d->dev)` on the freed object, writing kobject/device state into reclaimed slab memory and linking it into driver-core lists, which is a write primitive into attacker-influenceable reused heap; per UAF guidance this is High.\nA:H - Traversing `intc_list` through a freed `list_head` follows a stale/overwritten `next` pointer into arbitrary memory, producing an oops or panic, and it corrupts the suspend/resume syscore paths for the interrupt controller."
    }
  }
}