CVE-2024-50267

What it actually does

Use-after-free of the URB pointer in a debug printk call after usb_free_urb in the io_edgeport USB serial driver; the fix stores the dev pointer early to prevent access to freed memory.

Why it matters to the business

Kernel instability, crashes, or potential code execution on Linux systems handling USB serial devices can disrupt operations, enable lateral movement, or lead to full system compromise in environments with high USB device usage.

How an attack unfolds

An attacker triggers error paths in the io_edgeport driver to free a URB, then causes the subsequent dev_dbg to dereference the now-freed pointer; this has appeared in contexts of zero-day exploitation campaigns by espionage and financially motivated actors targeting Linux kernel memory issues.

How to fix it

Apply the upstream kernel patch that stores the device pointer before the free; upgrade affected kernels to versions containing the fix. For flashplugin-nonfree on Ubuntu 14.04 LTS, update to 11.2.202.554ubuntu0.14.04.1.

How to confirm the fix worked

Review kernel source for the stored dev pointer before usb_free_urb, boot test systems with USB serial devices while enabling debug logging, and confirm absence of use-after-free warnings in kernel logs or with memory debug tools.

Typical attack path

1. Attach or interact with a USB serial device managed by io_edgeport
2. Trigger an error condition that leads to usb_free_urb
3. Force execution of the debug printk that accesses the freed urb->dev
4. Exploit the resulting use-after-free for memory corruption or crash

How to detect it

Search kernel logs and dmesg for io_edgeport related oops, use-after-free warnings, or URB handling errors; correlate with USB attach events and any mentions in threat reports of espionage or financially motivated campaigns exploiting Linux kernel resource issues.

What your security team should do

• Prioritize kernel updates on systems exposing USB serial interfaces
• Monitor EPSS and threat actor activity around Linux kernel memory flaws for any increase in exploit maturity
• Restrict unneeded USB device access and enable kernel hardening features such as KASAN in test environments