CVE-2024-50073

What it actually does

Use-after-free in gsm_cleanup_mux when gsm_msg objects on tx_ctrl_list or tx_data_list are freed by concurrent threads via ioctl without protection from the gsm tx lock, allowing read of freed slab memory.

Why it matters to the business

Kernel instability, potential crashes, or local privilege escalation on systems running vulnerable Linux kernels with n_gsm multiplexing enabled; low immediate risk given stable low EPSS and no KEV listing, but still requires patching to maintain system integrity across deployments.

How an attack unfolds

An attacker with local access crafts multi-threaded ioctl sequences against a tty using the n_gsm line discipline to trigger concurrent access and freeing of gsm_msg structures, resulting in use-after-free during gsm_cleanup_mux; context from listed 2024 campaigns indicates possible use by espionage or financially motivated actors in broader Linux kernel exploitation patterns.

How to fix it

Update affected packages to the listed fixed versions: gcc-4.9 (Ubuntu:16.04:LTS) to 4.9.3-13ubuntu2 and gcc-5 (Ubuntu:16.04:LTS) to 5.3.1-14ubuntu2.1; rebuild and reboot into updated kernel images containing the gsm tx lock protection.

How to confirm the fix worked

Confirm package versions match the fixed releases above; verify absence of the vulnerable gsm_cleanup_mux+0x77b path via kernel symbols or source inspection; test with reproducer ioctls under KASAN to ensure no slab-use-after-free occurs.

Typical attack path

1. Obtain local unprivileged access on target system
2. Open or configure a tty device using n_gsm line discipline
3. Spawn multiple threads issuing ioctl calls to manipulate tx lists
4. Trigger gsm_cleanup_mux while messages are still referenced
5. Read or write to freed memory to achieve KASAN-detectable UAF or escalation

How to detect it

Search kernel logs for KASAN slab-use-after-free reports referencing gsm_cleanup_mux at drivers/tty/n_gsm.c:3160 and gsmld_ioctl; inspect audit or syscall logs for repeated ioctl calls on tty devices shortly before crashes; correlate with threat actor TTPs involving Linux kernel UAF primitives.

• gsm_cleanup_mux+0x77b/0x7b0
• BUG: KASAN: slab-use-after-free in gsm_cleanup_mux
• gsm_msg on the tx_ctrl_list or tx_data_list
• drivers/tty/n_gsm.c:3160

What your security team should do

• Prioritize patching systems with n_gsm usage within standard maintenance windows given low EPSS
• Monitor for new EPSS increases or KEV addition over the next 30 days
• Restrict unprivileged access to tty ioctls where n_gsm multiplexing is unnecessary
• Audit downstream dependents for exposure if ecosystem prevalence is high