Linux: Use After Free
CVE-2024-47730 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 85e81103033324d7a271dafb584991da39554a89, 801d64177faaec184cee1e1aa4d8487df1364a54, 98d3be34c9153eceadb56de50d9f9347e88d86e4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 85e81103033324d7a271dafb584991da39554a89 or 801d64177faaec184cee1e1aa4d8487df1364a54 or 98d3be34c9153eceadb56de50d9f9347e88d86e4 or aa3e0db35a60002fb34ef0e4ad203aa59fd00203, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.235 or 5.15.174 or 6.1.113 or 6.6.54, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, 85e81103033324d7a271dafb584991da39554a89; 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, 801d64177faaec184cee1e1aa4d8487df1364a54; 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, 98d3be34c9153eceadb56de50d9f9347e88d86e4; 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, aa3e0db35a60002fb34ef0e4ad203aa59fd00203; 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, f8024f12752e32ffbbf59e1c09d949f977ff743f; 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1; 6c6dd5802c2d6769fa589c0e8de54299def199a7 up to, but not including, b04f06fc0243600665b3b50253869533b7938468; 5.8 | 85e81103033324d7a271dafb584991da39554a89, 801d64177faaec184cee1e1aa4d8487df1364a54, 98d3be34c9153eceadb56de50d9f9347e88d86e4, aa3e0db35a60002fb34ef0e4ad203aa59fd00203, f8024f12752e32ffbbf59e1c09d949f977ff743f, c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1 |
| Debian | Debian Linux | 11.0 | Not stated |
| Linux | Linux Kernel | 5.8 up to, but not including, 5.10.235; 5.11 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.113; 6.2 up to, but not including, 6.6.54; 6.7 up to, but not including, 6.10.13; 6.11 up to, but not including, 6.11.2 | 5.10.235, 5.15.174, 6.1.113, 6.6.54, 6.10.13, 6.11.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.0 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/801d64177faaec184cee1e1aa4d8487df1364a54
- git.kernel.org/stable/c/85e81103033324d7a271dafb584991da39554a89
- git.kernel.org/stable/c/98d3be34c9153eceadb56de50d9f9347e88d86e4
- git.kernel.org/stable/c/aa3e0db35a60002fb34ef0e4ad203aa59fd00203
- git.kernel.org/stable/c/b04f06fc0243600665b3b50253869533b7938468
- git.kernel.org/stable/c/c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1
- git.kernel.org/stable/c/f8024f12752e32ffbbf59e1c09d949f977ff743f
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlMailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlMailing List, Third Party Advisory
Recent Use After Free vulnerabilities
- 7.0 High severity
- 7.0 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.