CyberSecBulletin
CVE-2024-46849NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-46849 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions a33145f494e6cb82f3e018662cc7c4febf271f22, 5a2cc2bb81399e9ebc72560541137eb04d61dc3d, fb0530025d502cb79d2b2801b14a9d5261833f1a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to a33145f494e6cb82f3e018662cc7c4febf271f22 or 5a2cc2bb81399e9ebc72560541137eb04d61dc3d or fb0530025d502cb79d2b2801b14a9d5261833f1a or e1a199ec31617242e1a0ea8f312341e682d0c037, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.285 or 5.10.227 or 5.15.168 or 6.1.111, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, a33145f494e6cb82f3e018662cc7c4febf271f22; 7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, 5a2cc2bb81399e9ebc72560541137eb04d61dc3d; 7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, fb0530025d502cb79d2b2801b14a9d5261833f1a; 7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, e1a199ec31617242e1a0ea8f312341e682d0c037; 7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, e43364f578cdc2f8083abbc0cb743ea55e827c29; 7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, 7d318166bf55e9029d56997c3b134f4ac2ae2607; 7864a79f37b55769b817d5e6c5ae0ca4bfdba93b up to, but not including, 4f9a71435953f941969a4f017e2357db62d85a86; 4.19a33145f494e6cb82f3e018662cc7c4febf271f22, 5a2cc2bb81399e9ebc72560541137eb04d61dc3d, fb0530025d502cb79d2b2801b14a9d5261833f1a, e1a199ec31617242e1a0ea8f312341e682d0c037, e43364f578cdc2f8083abbc0cb743ea55e827c29, 7d318166bf55e9029d56997c3b134f4ac2ae2607
DebianDebian Linux11.0Not stated
LinuxLinux Kernel4.19 up to, but not including, 5.4.285; 5.5 up to, but not including, 5.10.227; 5.11 up to, but not including, 5.15.168; 5.16 up to, but not including, 6.1.111; 6.2 up to, but not including, 6.6.52; 6.7 up to, but not including, 6.10.11; 6.115.4.285, 5.10.227, 5.15.168, 6.1.111, 6.6.52, 6.10.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use-after-free' Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: ================================================================== BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Use After Free vulnerabilities

Spotted an error? Tell us.