CVE-2024-50269

What it actually does

Use-after-free on the usb phy pointer stored in glue->xceiv after devm_usb_put_phy releases it during musb_driver unload; subsequent musb_probe via sunxi_musb_init dereferences the freed object.

Why it matters to the business

Linux systems using the sunxi musb USB controller may experience kernel crashes or memory corruption when USB platform drivers are repeatedly loaded and unloaded, leading to service outages and requiring kernel updates.

How an attack unfolds

An attacker with local access repeatedly registers and unregisters the musb platform driver to trigger the probe/exit sequence that releases the phy, then re-probes to access the dangling pointer and attempt to leverage the freed memory for code execution.

How to fix it

Update the Linux kernel to commit b562e44f507e863c6792946e4e1b1449fbbac85d or later; remove the devm_usb_put_phy call from sunxi_musb_exit as performed in the fix.

How to confirm the fix worked

Confirm the running kernel contains commit b562e44f507e863c6792946e4e1b1449fbbac85d; attempt repeated load/unload cycles of the sunxi_musb and musb drivers and verify no use-after-free warnings appear in dmesg.

Typical attack path

1. Load sunxi_musb platform driver to obtain phy reference
2. Load and then unload musb_driver to execute sunxi_musb_exit and release the phy
3. Reload musb_driver to call sunxi_musb_init and dereference the already-freed phy object
4. Manipulate the freed memory to achieve kernel code execution or denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings, slab corruption, or oops involving sunxi_musb, musb, or usb_phy; inspect for repeated driver probe/remove events preceding crashes.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all affected sunxi-based Linux systems
• Monitor kernel logs for musb and usb phy related oops or slab-use-after-free reports until patched
• Restrict unprivileged module loading where feasible to reduce trigger surface