CVE-2024-56766

What it actually does

The vulnerability allows a double free of a kernel memory structure in the atmel_pmecc_create_user function of the raw NAND driver after conversion to devm_kzalloc, leading to memory corruption or use-after-free conditions in the Linux kernel.

Why it matters to the business

Affected Linux systems using Atmel NAND flash may experience kernel crashes or local compromise on devices relying on the rawnand subsystem, increasing risk for embedded and server environments with high ecosystem prevalence.

How an attack unfolds

A local attacker triggers allocation and premature free paths in the NAND PMECC user structure handling, exploiting the remaining kfree call to corrupt kernel memory and potentially escalate privileges, though no specific threat actor campaigns are tied to this issue.

How to fix it

Update the Linux kernel to include commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be in the GIT repository or apply the equivalent fix in downstream distributions.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source or check for updated packages that remove the erroneous kfree call on the devm-allocated pointer; test NAND device initialization paths post-update.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Interact with NAND flash devices to invoke atmel_pmecc_create_user
3. Trigger the double free condition through device operations
4. Leverage resulting memory corruption for kernel-level exploitation

How to detect it

Review kernel logs and dmesg output for errors or crashes mentioning atmel_pmecc or double free conditions in the NAND subsystem; examine system call traces involving mtd devices for anomalous behavior.

What your security team should do

• Prioritize kernel updates to the fixed version across all affected systems
• Restrict unprivileged access to raw NAND interfaces where feasible
• Monitor kernel logs for oops or panic messages in mtd/rawnand drivers