CVE-2024-38630

What it actually does

A use-after-free vulnerability in the cpu5wdt watchdog driver occurs when del_timer() fails to stop a running timer handler before the port region is released during module removal, allowing the handler to access freed memory via outb().

Why it matters to the business

This flaw can lead to kernel crashes or potential code execution on affected Linux systems using the cpu5wdt module, increasing risk of system instability or compromise in environments with high Linux kernel prevalence.

How an attack unfolds

An attacker with ability to unload the cpu5wdt module while the timer is active can cause the timer handler cpu5wdt_trigger to execute after the port region is freed during release_region, resulting in use-after-free access.

How to fix it

Upgrade the Linux kernel to version 6.6.15-1 or later on Debian 13 systems. Change del_timer to timer_shutdown_sync in cpu5wdt.c to ensure the handler completes before region release.

How to confirm the fix worked

Confirm kernel version meets or exceeds 6.6.15-1 and inspect cpu5wdt.c source for timer_shutdown_sync usage in the removal path.

Typical attack path

1. Identify systems running the cpu5wdt watchdog module
2. Trigger module removal or unload sequence
3. Ensure the timer handler is concurrently executing
4. Access the released port region via outb in the handler

How to detect it

Review kernel logs for oops or panic messages referencing cpu5wdt_trigger and outb calls occurring after module unload events.

What your security team should do

• Apply the fixed kernel package 6.6.15-1 without delay on all Debian 13 deployments
• Audit for cpu5wdt module usage across the fleet
• Test module load/unload sequences in staging environments