CyberSecBulletin
CVE-2024-47696NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-47696 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions da2708a19f45b4a7278adf523837c8db21d1e2b5, 29b3bbd912b8db86df7a3c180b910ccb621f5635, 2efe8da2ddbf873385b4bc55366d09350b408df6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.73% chance of exploitation within 30 days, higher than 55% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to da2708a19f45b4a7278adf523837c8db21d1e2b5 or 29b3bbd912b8db86df7a3c180b910ccb621f5635 or 2efe8da2ddbf873385b4bc55366d09350b408df6 or da0392698c62397c19deb1b9e9bdf2fbb5a9420e, whichever matches your release line, or a later version.
  2. Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
  3. Update RUGGEDCOM RST2428P to V3.2 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd91d253c87fd1efece521ff2612078a35af673c6 up to, but not including, da2708a19f45b4a7278adf523837c8db21d1e2b5; 7f25f296fc9bd0435be14e89bf657cd615a23574 up to, but not including, 29b3bbd912b8db86df7a3c180b910ccb621f5635; 94ee7ff99b87435ec63211f632918dc7f44dac79 up to, but not including, 2efe8da2ddbf873385b4bc55366d09350b408df6; 557d035fe88d78dd51664f4dc0e1896c04c97cf6 up to, but not including, da0392698c62397c19deb1b9e9bdf2fbb5a9420e; dc8074b8901caabb97c2d353abd6b4e7fa5a59a5 up to, but not including, a64f30db12bdc937c5108158d98c8eab1925c548; ff5bbbdee08287d75d72e65b72a2b76d9637892a up to, but not including, 8b7df76356d098f85f3bd2c7cf6fb43f531893d7; ee39384ee787e86e9db4efb843818ef0ea9cb8ae up to, but not including, c8b18a75282cfd27822a8cc3c1f005c1ac8d1a58; aee2424246f9f1dadc33faa78990c1e2eb7826e4 up to, but not including, a09dc967b3c58899e259c0aea092f421d22a0b04; and 9 more rangesda2708a19f45b4a7278adf523837c8db21d1e2b5, 29b3bbd912b8db86df7a3c180b910ccb621f5635, 2efe8da2ddbf873385b4bc55366d09350b408df6, da0392698c62397c19deb1b9e9bdf2fbb5a9420e, a64f30db12bdc937c5108158d98c8eab1925c548, 8b7df76356d098f85f3bd2c7cf6fb43f531893d7
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
SiemensRUGGEDCOM RST2428Pbefore V3.2V3.2
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familybefore V3.2V3.2
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 familybefore V3.2V3.2
LinuxLinux Kernel4.19.320 up to, but not including, 5.4; 5.4.282 up to, but not including, 5.10; 5.10.224 up to, but not including, 5.10.227; 5.15.165 up to, but not including, 5.15.168; 6.1.103 up to, but not including, 6.1.113; 6.6.44 up to, but not including, 6.6.54; 6.10.3 up to, but not including, 6.10.13; 6.11 up to, but not including, 6.11.25.4, 5.10, 5.10.227, 5.15.168, 6.1.113, 6.6.54

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA
CVSS 3.17.8HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq. But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM. Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock. The call trace is as below: [ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.