CVE-2024-50051

What it actually does

Use-after-free in mpc52xx_spi_remove when the module is unloaded: spi_unregister_controller frees the 'ms' structure while the pending work item ms->work can still reference it.

Why it matters to the business

Local attackers with module-unload privileges can trigger kernel memory corruption on systems using the mpc52xx SPI controller, leading to crashes, data corruption, or potential privilege escalation; the vulnerability affects a wide range of Linux kernel deployments.

How an attack unfolds

An attacker with sufficient privileges triggers module removal (rmmod or modprobe -r) on a system exposing the mpc52xx SPI driver; the remove path frees controller state before canceling the asynchronous work item, allowing the work handler to dereference the now-freed structure and corrupt kernel memory.

How to fix it

Update the Linux kernel to a version containing commit d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1 which adds cancel_work_sync before spi_unregister_controller in mpc52xx_spi_remove; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Inspect the mpc52xx_spi.c source for the presence of cancel_work_sync immediately before spi_unregister_controller in the remove function; verify the running kernel was built from a tree containing d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1 or later.

Typical attack path

1. Obtain local access or privileges sufficient to unload kernel modules
2. Identify presence of mpc52xx_spi driver and trigger module removal sequence
3. Race the work item execution against the free in mpc52xx_spi_remove
4. Leverage resulting UAF for memory corruption or code execution

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing mpc52xx_spi or workqueue corruption around module unload events; correlate with audit logs showing rmmod or modprobe -r of the mpc52xx_spi module.

What your security team should do

• Prioritize kernel update to include d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1 on all systems using the mpc52xx SPI controller
• Restrict module unloading to trusted administrators via module blacklisting or capability controls
• Monitor for kernel oops or panic events coinciding with mpc52xx module unload operations