Security readout for executives and security teams
Plain-English summary
A flaw in the Linux efifb framebuffer driver can leave system-control files accessible after their supporting memory is freed. A locally authenticated user may be able to trigger memory corruption, potentially exposing sensitive kernel data or crashing the system. Network-only attackers are not directly positioned to exploit it.
Executive priority
Schedule prompt remediation, prioritizing shared servers, developer platforms, and other systems with untrusted local users. This is high severity but not evidenced as actively exploited or remotely reachable. Treat internet exposure alone as insufficient for prioritization; local-access pathways and efifb presence are the key factors.
Technical view
CVE-2024-49925 is a use-after-free race during efifb unregistration. Sysfs attributes could remain usable after the framebuffer information structure was freed. The correction delegates sysfs-group registration and cleanup to the driver core. CVSS 3.1 is 7.1: local, low-complexity exploitation requiring low privileges, with high confidentiality and availability impact.
Likely exposure
Exposure is limited to Linux systems running a vulnerable kernel where the efifb driver and affected sysfs interface are present. An attacker requires local low-privileged access. The supplied version data is ambiguous, so kernel version strings alone are insufficient; distribution backports and vendor package status must be checked.
Exploitation context
The supplied record is not in CISA KEV, and no cited source reports active exploitation. The CVSS assessment indicates low attack complexity after obtaining local low-privileged access. Practical exploitability depends on efifb usage, access to the relevant sysfs attributes, and winning the unregistration race.
Researcher notes
The core defect is a lifetime mismatch between efifb sysfs attributes and the freed framebuffer information structure. Driver-core-managed groups synchronize registration and cleanup. The supplied affected-version entries are duplicated and unclear, so they should not be treated as definitive branch boundaries. Confirm applicability through distribution advisories, package changelogs, or commit backports.
Mitigation direction
- Install a vendor-supported kernel package containing the applicable stable fix or backport.
- Reboot into the updated kernel and confirm the running version changed.
- Prioritize systems permitting untrusted or broadly shared local access.
- Restrict unnecessary local accounts while patching is pending.
- Consult distribution guidance before changing or disabling framebuffer functionality.
Validation and detection
- Inventory running kernel builds and identify systems using the efifb driver.
- Check vendor advisories for fixed package versions and backport status.
- Compare kernel source or package metadata with the cited stable fix commits.
- After reboot, verify the fixed kernel is running on each affected host.
- Review local account exposure and monitoring for unexplained kernel crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49925 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2d97b85eb5a86766ad0f8ea3d121e6ae144e3ed8CVE reference, Linux
- https://git.kernel.org/stable/c/2a9c40c72097b583b23aeb2a26d429ccfc81fbc1CVE reference, Linux
- https://git.kernel.org/stable/c/36bfefb6baaa8e46de44f4fd919ce4347337620fCVE reference, Linux
- https://git.kernel.org/stable/c/872cd2d029d2c970a8a1eea88b48dab2b3f2e93aCVE reference, Linux
- https://git.kernel.org/stable/c/4684d69b9670a83992189f6271dc0fcdec4ed0d7CVE reference, Linux
- https://git.kernel.org/stable/c/95cdd538e0e5677efbdf8aade04ec098ab98f457CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.