CVE-2024-57979 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-57979?

CVE-2024-57979 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's PPS (Pulse Per Second) subsystem. When unregistering a PPS device, the kernel frees memory that may still be accessed by previously opened character devices, potentially leading to kernel crashes or privilege escalation. Systems running affected Linux kernel versions with PPS devices (e.g., GPS receivers) are vulnerable.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's PPS (Pulse Per Second) subsystem. When unregistering a PPS device, the kernel frees memory that may still be accessed by previously opened character devices, potentially leading to kernel crashes or privilege escalation. Systems running affected Linux kernel versions with PPS devices (e.g., GPS receivers) are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution; generally Linux kernel versions up to 6.11.0-rc6)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if PPS subsystem is enabled and PPS devices are registered (e.g., GPS hardware with PPS support). Many systems may not use PPS functionality.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential privilege escalation to kernel mode, or arbitrary code execution in kernel context.

🟠

Likely Case

System instability, kernel crashes during device removal/reboot, denial of service affecting system availability.

🟢

If Mitigated

Minimal impact if PPS devices are not used or system is patched; isolated crashes in specific device removal scenarios.

🌐 Internet-Facing: LOW - This vulnerability requires local access or ability to interact with PPS devices, not typically exposed over network.

🏢 Internal Only: MEDIUM - Local users or processes with access to PPS devices could trigger crashes; privilege escalation risk exists but requires specific conditions.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger PPS device removal while devices are open. The bug was discovered during normal system operation (reboot with gpsd/ntpd running).

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 1a7735ab2cb9747518a7416fb5929e85442dec62 or later

Vendor Advisory: https://git.kernel.org/stable/c/1a7735ab2cb9747518a7416fb5929e85442dec62

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. For custom kernels, apply the fix commit to your kernel source. 3. Rebuild and install the kernel. 4. Reboot the system to load the patched kernel.

🔧 Temporary Workarounds

Disable PPS subsystem

Linux

Remove or disable PPS device support if not needed

# Check if PPS is loaded: lsmod | grep pps
# Remove module: sudo rmmod pps_core
# Blacklist to prevent loading: echo 'blacklist pps_core' | sudo tee /etc/modprobe.d/blacklist-pps.conf

Stop PPS-using services

Linux

Stop services like gpsd and ntpd that use PPS devices

sudo systemctl stop gpsd
sudo systemctl stop ntpd
# Consider disabling at boot: sudo systemctl disable gpsd ntpd

🧯 If You Can't Patch

Avoid rebooting systems with PPS devices in use
Ensure no processes have PPS devices open before device removal or system shutdown

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if PPS subsystem is loaded: uname -r && lsmod | grep -i pps

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test by rebooting with PPS devices active while monitoring kernel logs for the warning message

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing 'kobject_put' warning with null kobject
'refcount_t: underflow; use-after-free' messages
Kernel panic messages related to list_debug.c

Network Indicators:

No network indicators - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("kobject_put" OR "use-after-free" OR "pps" AND "panic")

📊 Metadata

CVE ID: CVE-2024-57979

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.06% exploit probability (17.2th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-57979, you might also want to check these: