GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-57887 (GCVE-0-2024-57887)

Vulnerability from cvelistv5 – Published: 2025-01-15 13:05 – Updated: 2026-08-05 11:46
VLAI
Title
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-11 15:41 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e4d58cd7f888522d16f221d628356befbb08468 , < acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087 (git)
Affected: 1e4d58cd7f888522d16f221d628356befbb08468 , < d208571943ffddc438a7ce533d5d0b9219806242 (git)
Affected: 1e4d58cd7f888522d16f221d628356befbb08468 , < 1f49aaf55652580ae63ab83d67211fe6a55d83dc (git)
Affected: 1e4d58cd7f888522d16f221d628356befbb08468 , < ca9d077350fa21897de8bf64cba23b198740aab5 (git)
Affected: 1e4d58cd7f888522d16f221d628356befbb08468 , < 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 6.1.125 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.9 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:41:02.098939Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:19.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:54:56.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c",
            "drivers/gpu/drm/bridge/adv7511/adv7533.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087",
              "status": "affected",
              "version": "1e4d58cd7f888522d16f221d628356befbb08468",
              "versionType": "git"
            },
            {
              "lessThan": "d208571943ffddc438a7ce533d5d0b9219806242",
              "status": "affected",
              "version": "1e4d58cd7f888522d16f221d628356befbb08468",
              "versionType": "git"
            },
            {
              "lessThan": "1f49aaf55652580ae63ab83d67211fe6a55d83dc",
              "status": "affected",
              "version": "1e4d58cd7f888522d16f221d628356befbb08468",
              "versionType": "git"
            },
            {
              "lessThan": "ca9d077350fa21897de8bf64cba23b198740aab5",
              "status": "affected",
              "version": "1e4d58cd7f888522d16f221d628356befbb08468",
              "versionType": "git"
            },
            {
              "lessThan": "81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8",
              "status": "affected",
              "version": "1e4d58cd7f888522d16f221d628356befbb08468",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c",
            "drivers/gpu/drm/bridge/adv7511/adv7533.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: adv7511: Fix use-after-free in adv7533_attach_dsi()\n\nThe host_node pointer was assigned and freed in adv7533_parse_dt(), and\nlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issue\nby\u00a0dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()\nin error path of probe() and also in the remove()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is an I2C/DRM-bridge probe path reached only through local device-management interfaces \u2014 sysfs driver bind/unbind, module load, or configfs DT-overlay add/remove \u2014 with no network or adjacent-network reachability. Physical access to the soldered ADV7533/ADV7535 confers no additional capability, so Local is the correct and higher-severity vector.\nAC:L - There is no race to win: dropping the reference in adv7533_parse_dt() deterministically permits the backing device_node to be freed, and the attacker drives both the free (overlay removal / detach) and the subsequent use (probe or probe-deferral retry of adv7533_attach_dsi()). Repeated bind/unbind cycles and the -EPROBE_DEFER retry loop let the attacker groom the freed kmalloc slab at will.\nPR:L - Neither adv7511_probe(), adv7533_parse_dt(), nor adv7533_attach_dsi() contains any capable()/CAP_* gate; access is governed solely by file permissions on the sysfs/configfs device-management nodes, which on the embedded, industrial and automotive ARM64 platforms where ADV7533/ADV7535 is deployed are routinely delegated to non-root device-manager and display service accounts. Real root in the initial namespace is not required.\nUI:N - The attacker triggers the sequence entirely on their own by driving the overlay/bind cycle; the stale pointer is also consumed automatically on every boot-time deferred-probe retry. No victim action, mount, or file open is involved.\nS:U - The freed struct device_node, the DSI host list, and the resulting corruption all live in the kernel of the same system under a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of a kmalloc\u0027d struct device_node in a general-purpose slab cache, so the attacker can reallocate the freed object with controlled content and steer the of_find_mipi_dsi_host_by_node() match and the ensuing mipi_dsi device registration. That yields disclosure of kernel pointers and adjacent slab contents, and UAF is scored High.\nI:H - Once the node is freed and its address reused, the pointer comparison can alias a different live DSI host, causing the bridge to register and attach against the wrong mipi_dsi_host \u2014 a type-confused attachment that programs the wrong hardware and writes through mismatched structures. The freed slab object additionally provides the write target that makes UAFs exploitable for control-flow hijacking.\nA:H - Using the dangling device_node after the overlay teardown produces a KASAN slab-use-after-free and an oops-class fault (panic with panic_on_warn), and a mis-attached DSI device leaves the display pipeline dead. The attacker can repeat the bind/unbind or overlay cycle indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:46.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087"
        },
        {
          "url": "https://git.kernel.org/stable/c/d208571943ffddc438a7ce533d5d0b9219806242"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f49aaf55652580ae63ab83d67211fe6a55d83dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca9d077350fa21897de8bf64cba23b198740aab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8"
        }
      ],
      "title": "drm: adv7511: Fix use-after-free in adv7533_attach_dsi()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57887",
    "datePublished": "2025-01-15T13:05:39.933Z",
    "dateReserved": "2025-01-11T14:45:42.027Z",
    "dateUpdated": "2026-08-05T11:46:46.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57887",
      "date": "2026-09-17",
      "epss": "0.00209",
      "percentile": "0.11286"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:17:42.000Z",
      "cve": "CVE-2024-57887",
      "id": "msrc_CVE-2024-57887",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm: adv7511: Fix use-after-free in adv7533_attach_dsi()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57887.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57887\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:13.130\",\"lastModified\":\"2026-06-17T08:14:09.020\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm: adv7511: Fix use-after-free in adv7533_attach_dsi()\\n\\nThe host_node pointer was assigned and freed in adv7533_parse_dt(), and\\nlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issue\\nby\u00a0dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()\\nin error path of probe() and also in the remove().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm: adv7511: Se corrige el use-after-free en adv7533_attach_dsi() El puntero host_node se asign\u00f3 y liber\u00f3 en adv7533_parse_dt() y, posteriormente, adv7533_attach_dsi() utiliza el mismo. Corrija este problema de use-after-free eliminando of_node_put() en adv7533_parse_dt() y llamando a of_node_put() en la ruta de error de probe() y tambi\u00e9n en remove().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/bridge/adv7511/adv7511_drv.c\",\"drivers/gpu/drm/bridge/adv7511/adv7533.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1e4d58cd7f888522d16f221d628356befbb08468\",\"lessThan\":\"acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e4d58cd7f888522d16f221d628356befbb08468\",\"lessThan\":\"d208571943ffddc438a7ce533d5d0b9219806242\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e4d58cd7f888522d16f221d628356befbb08468\",\"lessThan\":\"1f49aaf55652580ae63ab83d67211fe6a55d83dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e4d58cd7f888522d16f221d628356befbb08468\",\"lessThan\":\"ca9d077350fa21897de8bf64cba23b198740aab5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e4d58cd7f888522d16f221d628356befbb08468\",\"lessThan\":\"81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/bridge/adv7511/adv7511_drv.c\",\"drivers/gpu/drm/bridge/adv7511/adv7533.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.125\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.9\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:41:02.098939Z\",\"id\":\"CVE-2024-57887\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.8\",\"versionEndExcluding\":\"6.1.125\",\"matchCriteriaId\":\"A0875CA1-396F-40B6-8C05-4834D4ED10CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"51E6CFF2-92AA-4936-95AB-2D068168A696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.9\",\"matchCriteriaId\":\"1D13AF97-FFED-4B68-906D-CFE38D0B88DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f49aaf55652580ae63ab83d67211fe6a55d83dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ca9d077350fa21897de8bf64cba23b198740aab5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d208571943ffddc438a7ce533d5d0b9219806242\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-12T12:18:05+00:00",
      "cve": "CVE-2024-57887",
      "id": "CVE-2024-57887",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm: adv7511: Fix use-after-free in adv7533_attach_dsi()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57887.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:54:56.908Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-57887\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:41:02.098939Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:41:03.444Z\"}}], \"cna\": {\"title\": \"drm: adv7511: Fix use-after-free in adv7533_attach_dsi()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is an I2C/DRM-bridge probe path reached only through local device-management interfaces \\u2014 sysfs driver bind/unbind, module load, or configfs DT-overlay add/remove \\u2014 with no network or adjacent-network reachability. Physical access to the soldered ADV7533/ADV7535 confers no additional capability, so Local is the correct and higher-severity vector.\\nAC:L - There is no race to win: dropping the reference in adv7533_parse_dt() deterministically permits the backing device_node to be freed, and the attacker drives both the free (overlay removal / detach) and the subsequent use (probe or probe-deferral retry of adv7533_attach_dsi()). Repeated bind/unbind cycles and the -EPROBE_DEFER retry loop let the attacker groom the freed kmalloc slab at will.\\nPR:L - Neither adv7511_probe(), adv7533_parse_dt(), nor adv7533_attach_dsi() contains any capable()/CAP_* gate; access is governed solely by file permissions on the sysfs/configfs device-management nodes, which on the embedded, industrial and automotive ARM64 platforms where ADV7533/ADV7535 is deployed are routinely delegated to non-root device-manager and display service accounts. Real root in the initial namespace is not required.\\nUI:N - The attacker triggers the sequence entirely on their own by driving the overlay/bind cycle; the stale pointer is also consumed automatically on every boot-time deferred-probe retry. No victim action, mount, or file open is involved.\\nS:U - The freed struct device_node, the DSI host list, and the resulting corruption all live in the kernel of the same system under a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a use-after-free of a kmalloc\u0027d struct device_node in a general-purpose slab cache, so the attacker can reallocate the freed object with controlled content and steer the of_find_mipi_dsi_host_by_node() match and the ensuing mipi_dsi device registration. That yields disclosure of kernel pointers and adjacent slab contents, and UAF is scored High.\\nI:H - Once the node is freed and its address reused, the pointer comparison can alias a different live DSI host, causing the bridge to register and attach against the wrong mipi_dsi_host \\u2014 a type-confused attachment that programs the wrong hardware and writes through mismatched structures. The freed slab object additionally provides the write target that makes UAFs exploitable for control-flow hijacking.\\nA:H - Using the dangling device_node after the overlay teardown produces a KASAN slab-use-after-free and an oops-class fault (panic with panic_on_warn), and a mis-attached DSI device leaves the display pipeline dead. The attacker can repeat the bind/unbind or overlay cycle indefinitely.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1e4d58cd7f888522d16f221d628356befbb08468\", \"lessThan\": \"acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e4d58cd7f888522d16f221d628356befbb08468\", \"lessThan\": \"d208571943ffddc438a7ce533d5d0b9219806242\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e4d58cd7f888522d16f221d628356befbb08468\", \"lessThan\": \"1f49aaf55652580ae63ab83d67211fe6a55d83dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e4d58cd7f888522d16f221d628356befbb08468\", \"lessThan\": \"ca9d077350fa21897de8bf64cba23b198740aab5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e4d58cd7f888522d16f221d628356befbb08468\", \"lessThan\": \"81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/bridge/adv7511/adv7511_drv.c\", \"drivers/gpu/drm/bridge/adv7511/adv7533.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.234\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.125\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/bridge/adv7511/adv7511_drv.c\", \"drivers/gpu/drm/bridge/adv7511/adv7533.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087\"}, {\"url\": \"https://git.kernel.org/stable/c/d208571943ffddc438a7ce533d5d0b9219806242\"}, {\"url\": \"https://git.kernel.org/stable/c/1f49aaf55652580ae63ab83d67211fe6a55d83dc\"}, {\"url\": \"https://git.kernel.org/stable/c/ca9d077350fa21897de8bf64cba23b198740aab5\"}, {\"url\": \"https://git.kernel.org/stable/c/81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm: adv7511: Fix use-after-free in adv7533_attach_dsi()\\n\\nThe host_node pointer was assigned and freed in adv7533_parse_dt(), and\\nlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issue\\nby\\u00a0dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()\\nin error path of probe() and also in the remove().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.234\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.125\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.9\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:46.586Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-57887\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:46.586Z\", \"dateReserved\": \"2025-01-11T14:45:42.027Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-15T13:05:39.933Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.