CVE-2024-35792

What it actually does

Use-after-free in the rk3288 crypto driver because the unprepare call occurs after finalize, which frees the request structure.

Why it matters to the business

Kernel instability or crashes on affected Linux systems using rk3288 hardware crypto, with potential for local privilege escalation; low exploitability reduces immediate risk but still requires patching for reliability.

How an attack unfolds

An attacker with local access triggers crypto requests on rk3288 hardware in a sequence that allows finalize to free memory before unprepare accesses the now-freed request.

How to fix it

Update the Linux kernel to a version containing commit 18500fa313a9f1ee1be48aa111c0eeea001010fa; apply the listed fixed package versions for any affected distributions.

How to confirm the fix worked

Confirm the driver source contains the corrected call order (unprepare before finalize) and test crypto operations to ensure no use-after-free occurs.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Trigger crypto operations involving the rk3288 driver
3. Force finalize to execute before unprepare
4. Access freed memory for crash or code execution

How to detect it

Review kernel logs for oops or panic messages referencing rk3288 unprepare or finalize; inspect crypto request handling traces for evidence of premature freeing.

What your security team should do

• Prioritize kernel updates on systems using rk3288 crypto acceleration
• Monitor for related kernel panics in logs
• Restrict local access where possible until patched