Security readout for executives and security teams
Plain-English summary
A flaw in the Linux ZynqMP display driver can leave userspace interacting with a device while it is being removed, causing access to freed memory. A low-privileged local user may threaten system confidentiality, integrity, or availability. Exposure is limited to systems using the affected driver and requires local access.
Executive priority
Treat as a high-priority platform patch for exposed ZynqMP systems, particularly shared or locally accessible appliances. It is less urgent for systems without this driver or without untrusted local access. Require asset-specific confirmation because the supplied affected-version data is insufficient for reliable fleet-wide matching.
Technical view
CVE-2024-56538 is a CWE-416 use-after-free in drm/zynqmp_kms. The corrected removal sequence first unplugs the DRM device, making subsequent userspace accesses return errors instead of entering removed driver internals. CVSS 3.1 rates it 7.8: local, low-complexity, low-privilege, no user interaction, with high confidentiality, integrity, and availability impacts.
Likely exposure
Most relevant to Linux systems using the ZynqMP KMS DRM driver where low-privileged users can access the device. The supplied version information is ambiguous and lacks CPEs, so kernel package or distribution exposure cannot be determined from version numbers alone.
Exploitation context
The supplied record indicates a local attack requiring low privileges, not remote exploitation. It is not listed in the supplied KEV data, and the sources provide no evidence of active exploitation or a public working exploit.
Researcher notes
The record repeats commit d76271d22694 and includes an unexplained version “0,” while providing no CPEs. Four stable-tree correction commits are referenced, likely reflecting different maintained branches. Exact introduction and fixed-version boundaries should be established through distribution advisories or commit ancestry; the supplied bundle alone does not support a precise range.
Mitigation direction
- Apply a distribution or vendor kernel incorporating the applicable upstream stable correction.
- Consult the Linux or device vendor for exact fixed package versions before deployment.
- Prioritize systems exposing the ZynqMP DRM device to untrusted local users.
Validation and detection
- Identify systems containing or loading the ZynqMP KMS DRM driver.
- Record each active kernel package and build, then compare it with vendor guidance.
- Confirm the installed kernel includes the applicable stable correction commit.
- Regression-test graphics operation and device removal after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56538 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a17b9afe58c474657449cf87e238b1788200576bCVE reference, Linux
- https://git.kernel.org/stable/c/4fb97432e28a7e136b2d76135d50e988ada8e1afCVE reference, Linux
- https://git.kernel.org/stable/c/692f52aedccbf79b212a1e14e3735192b4c24a7dCVE reference, Linux
- https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.