CVE-2024-50159

What it actually does

Double free of dbg->name pointer in scmi_debugfs_common_setup when devm_add_action_or_reset fails, allowing the cleanup routine to execute twice and corrupting kernel memory structures.

Why it matters to the business

Kernel-level memory corruption can cause system crashes, denial of service, or potential privilege escalation on affected Linux systems, increasing operational risk and requiring urgent patching across server and embedded deployments.

How an attack unfolds

An attacker with local access triggers the SCMI debugfs initialization path, forces devm_add_action_or_reset to fail, and reuses the already-freed dbg->name pointer to corrupt kernel memory or achieve code execution; listed threat actors have targeted similar Linux kernel memory issues in espionage and financial campaigns.

How to fix it

Update to a kernel version containing the fix that removes the redundant scmi_debugfs_common_cleanup call; for listed Ubuntu packages apply the provided fixed versions such as firefox 43.0+build1-0ubuntu0.14.04.1 and thunderbird 1:38.5.1+build2-0ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the patch is present by inspecting drivers/firmware/arm_scmi/driver.c around line 2915 for removal of the duplicate cleanup call, then verify no double-free warnings from static analyzers and test SCMI debugfs initialization under failure conditions.

Typical attack path

1. Obtain local access or execute code on a system using the arm_scmi driver
2. Trigger debugfs setup for SCMI protocol
3. Cause devm_add_action_or_reset to return failure
4. Reuse the double-freed dbg->name pointer for memory corruption or control-flow hijack

How to detect it

Review kernel logs for double-free warnings or oops messages involving arm_scmi and debugfs; inspect audit logs for unexpected local process activity targeting firmware drivers; correlate with known Linux kernel memory corruption patterns reported by threat actors.

What your security team should do

• Prioritize kernel updates on all systems exposing SCMI firmware interfaces
• Monitor EPSS trend and threat actor activity for similar memory issues
• Apply the exact fixed package versions supplied for affected distributions
• Restrict debugfs access and local user privileges until patched