CVE-2024-50073
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's GSM multiplexer (n_gsm) allows attackers to potentially execute arbitrary code or cause denial of service. The vulnerability occurs when multiple threads access freed memory through ioctl operations, affecting systems using GSM modem functionality.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.
Likely Case
Kernel panic or system crash causing denial of service.
If Mitigated
No impact if GSM modem functionality is disabled or systems are properly patched.
🎯 Exploit Status
Exploit requires local access and knowledge of GSM modem operations. The KASAN report shows a proof-of-concept exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 0eec592c6a7460ba795d7de29f3dc95cb5422e62 or later
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version. 2. Reboot system. 3. Verify kernel version is updated.
🔧 Temporary Workarounds
Disable GSM modem functionality
linuxUnload the n_gsm kernel module if not needed
sudo rmmod n_gsm
Blacklist n_gsm module
linuxPrevent n_gsm module from loading at boot
echo 'blacklist n_gsm' | sudo tee /etc/modprobe.d/blacklist-n_gsm.conf
🧯 If You Can't Patch
- Restrict local user access to systems with GSM modem functionality
- Implement strict access controls and monitoring for GSM modem operations
🔍 How to Verify
Check if Vulnerable:
Check if n_gsm module is loaded: lsmod | grep n_gsmCheck Version:
uname -rVerify Fix Applied:
Check kernel version against patched versions from vendor advisories📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KASAN reports mentioning gsm_cleanup_mux
- System crashes related to n_gsm
Network Indicators:
- Unusual GSM modem activity from unauthorized users
SIEM Query:
Search for kernel logs containing 'gsm_cleanup_mux' or 'n_gsm' with error/panic indicators🔗 References
- https://git.kernel.org/stable/c/0eec592c6a7460ba795d7de29f3dc95cb5422e62
- https://git.kernel.org/stable/c/9462f4ca56e7d2430fdb6dcc8498244acbfc4489
- https://git.kernel.org/stable/c/bf171b5e86e41de4c1cf32fb7aefa275c3d7de49
- https://git.kernel.org/stable/c/c29f192e0d44cc1cbaf698fa1ff198f63556691a
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
