CVE-2024-42302

What it actually does

Use-after-free in pci_bridge_wait_for_secondary_bus() when dpc_handler() concurrently accesses a child pci_dev that pciehp has removed, leading to invalid memory reads in pci_bus_read_config_dword and kernel oops.

Why it matters to the business

Unexpected system crashes and reboots on servers with PCIe hotplug or DPC hardware, causing service outages and potential data corruption in environments with 496 downstream dependents.

How an attack unfolds

An attacker with local access triggers a DPC event on a downstream port while simultaneously performing hot-removal of the same hierarchy segment; the missing reference count allows the freed struct pci_dev to be dereferenced during bus readiness polling, crashing the kernel.

How to fix it

Update to a fixed kernel version that acquires the missing reference on the child device in pci_bridge_wait_for_secondary_bus before the DPC path was introduced; apply the stable backports for kernels 5.10 and later.

How to confirm the fix worked

Confirm the presence of the reference acquisition patch in pci_bridge_wait_for_secondary_bus; test concurrent DPC and hot-removal scenarios in a lab environment to verify no oops occurs.

Typical attack path

1. Obtain local access on a Linux system running kernel 5.10+
2. Trigger DPC error on a PCIe downstream port
3. Concurrently initiate hot-removal of the affected device hierarchy
4. Cause pci_bridge_wait_for_secondary_bus to access freed child device
5. Trigger kernel page fault and denial of service

How to detect it

Review kernel logs for BUG: unable to handle page fault during irq/XX-pcie-dpc and the stack trace involving pci_bridge_wait_for_secondary_bus and dpc_handler; correlate with hot-removal events in dmesg.

What your security team should do

• Prioritize patching kernels on systems with PCIe DPC and hotplug hardware due to the 786 days since publication
• Monitor for kernel oops logs matching the described stack trace
• Restrict unprivileged local access on affected systems until patched