CyberSecBulletin
CVE-2024-35955NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-35955 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions b5808d40093403334d939e2c3c417144d12a6f33, 93eb31e7c3399e326259f2caa17be1e821f5a412, 5062d1f4f07facbdade0f402d9a04a788f52e26d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.18% chance of exploitation within 30 days, higher than 68% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to b5808d40093403334d939e2c3c417144d12a6f33 or 93eb31e7c3399e326259f2caa17be1e821f5a412 or 5062d1f4f07facbdade0f402d9a04a788f52e26d or 2df2dd27066cdba8041e46a64362325626bdfb2e, whichever matches your release line, or a later version.
  2. Update linux_kernel to b5808d400934 or 93eb31e7c339 or 2df2dd27066c or 62029bc9ff2c, whichever matches your release line, or a later version.
  3. Update RUGGEDCOM RST2428P to V3.1 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8 up to, but not including, b5808d40093403334d939e2c3c417144d12a6f33; 6a119c1a584aa7a2c6216458f1f272bf1bc93a93 up to, but not including, 93eb31e7c3399e326259f2caa17be1e821f5a412; 2a49b025c36ae749cee7ccc4b7e456e02539cdc3 up to, but not including, 5062d1f4f07facbdade0f402d9a04a788f52e26d; a1edb85e60fdab1e14db63ae8af8db3f0d798fb6 up to, but not including, 2df2dd27066cdba8041e46a64362325626bdfb2e; 28f6c37a2910f565b4f5960df52b2eccae28c891 up to, but not including, 62029bc9ff2c17a4e3a2478d83418ec575413808; 28f6c37a2910f565b4f5960df52b2eccae28c891 up to, but not including, d15023fb407337028a654237d8968fefdcf87c2f; 28f6c37a2910f565b4f5960df52b2eccae28c891 up to, but not including, 36b57c7d2f8b7de224980f1a284432846ad71ca0; 28f6c37a2910f565b4f5960df52b2eccae28c891 up to, but not including, 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8; and 11 more rangesb5808d40093403334d939e2c3c417144d12a6f33, 93eb31e7c3399e326259f2caa17be1e821f5a412, 5062d1f4f07facbdade0f402d9a04a788f52e26d, 2df2dd27066cdba8041e46a64362325626bdfb2e, 62029bc9ff2c17a4e3a2478d83418ec575413808, d15023fb407337028a654237d8968fefdcf87c2f
Linuxlinux_kernel1c836bad43f3 up to, but not including, b5808d400934; 6a119c1a584a up to, but not including, 93eb31e7c339; 2a49b025c36a up to, but not including, 93eb31e7c339; a1edb85e60fd up to, but not including, 2df2dd27066c; 28f6c37a2910 up to, but not including, 62029bc9ff2c; 28f6c37a2910 up to, but not including, d15023fb4073; 28f6c37a2910 up to, but not including, 36b57c7d2f8b; 28f6c37a2910 up to, but not including, 325f3fb551f8; and 1 more rangesb5808d400934, 93eb31e7c339, 2df2dd27066c, 62029bc9ff2c, d15023fb4073, 36b57c7d2f8b
SiemensRUGGEDCOM RST2428Pbefore V3.1V3.1
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familyNot specified in the recordNot stated
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 familybefore V3.1V3.1
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
DebianDebian Linux10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Use After Free vulnerabilities

Spotted an error? Tell us.