CVE-2024-50267

A flaw was found in the Linux kernel's Edgeport USB serial driver. A use-after-free vulnerability—where system memory is accessed after being released—occurs when the driver logs debug messages referencing a deallocated USB request block. A local user with administrative privileges could exploit this issue when debug logging is active to cause a Denial of Service (DoS) via a system crash or potential memory corruption.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H) in the debug mode.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the io_edgeport kernel module from loading:

1. Create a configuration file to disable autoloading of the module:

echo "install io_edgeport /bin/true" > /etc/modprobe.d/io_edgeport.conf

2. If the module is already active in memory, unload it:

modprobe -r io_edgeport

Warning: A system reboot may be required to fully unload the module if it is currently in use. Blacklisting this driver will disable support for Inside Out Networks Edgeport USB serial converters.