CVE-2024-57904

What it actually does

Use-after-free in at91_ts_register() due to input_free_device() being invoked on st->ts_input before the allocated iio_dev is assigned, allowing access to a freed or uninitialized input device structure on error paths.

Why it matters to the business

Systems running affected kernel versions risk crashes, denial of service, or potential local privilege escalation during touch screen or ADC initialization, increasing operational downtime and security exposure especially in embedded or industrial deployments with high Linux kernel prevalence.

How an attack unfolds

An attacker with local access triggers the error path in at91_ts_register() before st->ts_input assignment, causing input_free_device() to operate on an invalid pointer; subsequent use of the freed structure leads to memory corruption that can be leveraged for code execution, consistent with observed patterns in Linux kernel resource handling flaws exploited by espionage and financially motivated actors.

How to fix it

Update to fixed kernel commits such as b549c90bfe66f704878aa1e57b30ba15dab71935 or later stable releases; for Red Hat packages apply chromium-browser 50.0.2661.94-1.el6 or equivalent kernel updates containing the input_free_device() correction.

How to confirm the fix worked

Verify kernel source contains the corrected input_free_device() call on the local input variable, confirm driver initialization completes without triggering the err label prematurely, and test on affected hardware that no use-after-free warnings appear in dmesg or kmemleak.

Typical attack path

1. Obtain local code execution on target system
2. Load or trigger at91 ADC/touchscreen driver initialization
3. Force error condition in at91_ts_register() prior to assignment
4. Trigger use of the improperly freed input device structure
5. Exploit resulting memory corruption for privilege escalation or DoS

How to detect it

Inspect kernel logs for input_free_device warnings or use-after-free oops involving at91_ts or iio_dev structures; review auditd and dmesg for abnormal driver load sequences around ADC initialization; correlate with known Linux kernel UAF patterns from espionage campaigns.

What your security team should do

• Prioritize patching kernel packages on all systems using at91 ADC or touchscreen drivers within the CISA-style remediation window if applicable
• Monitor EPSS trend and threat actor reports for any increase in Linux kernel UAF exploitation
• Apply updates from stable git trees or vendor backports immediately given 630+ days since publication
• Review downstream dependent packages for inherited exposure