Security readout for executives and security teams
Plain-English summary
CVE-2024-57979 is a Linux kernel use-after-free in the PPS timing subsystem. On systems using PPS sources, such as GPS timing with gpsd and ntpd, removing a PPS device can leave old file operations callable and trigger memory corruption, crashes, or kernel panic. The issue is local, not remotely reachable from the cited sources.
Executive priority
High priority for fleets using Linux PPS or GPS-backed time synchronization, especially operational technology or embedded systems. For general servers without PPS devices, handle through normal kernel patch governance after confirming exposure. No cited evidence supports emergency internet-wide exploitation.
Technical view
The PPS driver freed a pps_device containing an embedded character device after cdev_del(), even though existing opened character-device file operations can still run. Kernel stable fixes rework PPS character-device registration and reference handling so pps_idr tracks visibility and holds a device reference until unregister completes.
Likely exposure
Exposure is most likely on Linux systems with affected kernels that use PPS devices or GPS timing sources. Embedded, industrial, telecom, time-synchronization, and Raspberry Pi-like deployments running gpsd or ntpd deserve priority review. The supplied CVSS vector requires local access and low privileges.
Exploitation context
The provided sources do not show active exploitation, and KEV is false. The observed trigger was gpsd exiting during reboot on a PPS-enabled board, causing warnings, refcount underflow, memory corruption symptoms, and kernel panic. Treat this mainly as local privilege, integrity, and availability risk until vendor evidence says otherwise.
Researcher notes
The root cause is lifetime mismatch after cdev_del(): prior opens can still call fops while the embedded cdev storage is freed. The fix removes the embedded cdev pattern and adjusts idr/device reference ownership. Evidence is strong for bug mechanics, but exploitability beyond crash or corruption is not demonstrated in the bundle.
Mitigation direction
- Upgrade to a vendor kernel containing the PPS stable fixes.
- Review Debian LTS and Siemens guidance if those environments apply.
- Prioritize PPS/GPS timing systems with local users or strict uptime needs.
- Restrict unnecessary local access until patched.
- If PPS is not required, consult vendor guidance before disabling related services.
Validation and detection
- Inventory Linux kernel versions across PPS-capable systems.
- Identify hosts running gpsd, ntpd, or PPS timing hardware.
- Confirm vendor backports include the referenced stable kernel fixes.
- Review logs for pps removed, kobject_put, refcount underflow, or list_debug BUG.
- Test reboot and PPS unregister behavior after patching.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 785c78ed
- Linux stable commit 1a7735ab
- Linux stable commit c4041b6b
- Linux stable commit 91932db1
- Linux stable commit cd3bbcb6
- Linux stable commit 7e5ee328
- Linux stable commit 85241f7d
- Linux stable commit c79a39dc
- Debian LTS advisory May 2025
- Debian LTS advisory March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57979 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/785c78ed0d39d1717cca3ef931d3e51337b5e90eCVE reference, Linux
- https://git.kernel.org/stable/c/1a7735ab2cb9747518a7416fb5929e85442dec62CVE reference, Linux
- https://git.kernel.org/stable/c/c4041b6b0a7a3def8cf3f3d6120ff337bc4c40f7CVE reference, Linux
- https://git.kernel.org/stable/c/91932db1d96b2952299ce30c1c693d834d10ace6CVE reference, Linux
- https://git.kernel.org/stable/c/cd3bbcb6b3a7caa5ce67de76723b6d8531fb7f64CVE reference, Linux
- https://git.kernel.org/stable/c/7e5ee3281dc09014367f5112b6d566ba36ea2d49CVE reference, Linux
- https://git.kernel.org/stable/c/85241f7de216f8298f6e48540ea13d7dcd100870CVE reference, Linux
- https://git.kernel.org/stable/c/c79a39dc8d060b9e64e8b0fa9d245d44befeefbeCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.