CVE-2024-53165

What it actually does

Use-after-free occurs when a controller structure is freed in an error path of register_intc_controller without first being removed from the intc_list, allowing subsequent accesses to the dangling pointer.

Why it matters to the business

Kernel instability, potential crashes, or privilege escalation on affected Linux systems; low EPSS and absence from KEV reduce immediate widespread risk, though prevalence of the kernel component increases exposure surface.

How an attack unfolds

An attacker supplies input that forces the error handling path in register_intc_controller, causing the freed structure to remain referenced via intc_list; later code dereferences the dangling pointer for read or write operations, enabling memory corruption.

How to fix it

Update to a kernel containing the fix that adds the structure to intc_list only after all operations succeed; for listed flashplugin-nonfree packages apply version 11.2.202.632ubuntu0.14.04.1 or later.

How to confirm the fix worked

Confirm the patch is present by inspecting the register_intc_controller function for list insertion after successful completion; test error paths to ensure no premature free occurs.

Typical attack path

1. Trigger registration of an interrupt controller via the affected function
2. Force an error condition after allocation but before list insertion
3. Reuse the freed structure through the stale list entry
4. Achieve memory corruption or information leak

How to detect it

Review kernel logs and crash dumps for use-after-free patterns in interrupt controller registration; correlate with any process activity attempting to register controllers.

What your security team should do

• Prioritize kernel updates on all systems running the affected sh:intc code
• Monitor for any new exploitation reports despite current low EPSS
• Apply the exact fixed package versions where flashplugin-nonfree is present