CyberSecBulletin
CVE-2024-49903NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-49903 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 4ac58f7734937f3249da734ede946dfb3b1af5e4, 3126ccde51f51b0648c8cdccaf916e8bd062e972, fd026b6b6758d5569705c02540b40f3bbf822b9a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 4ac58f7734937f3249da734ede946dfb3b1af5e4 or 3126ccde51f51b0648c8cdccaf916e8bd062e972 or fd026b6b6758d5569705c02540b40f3bbf822b9a or e7ae14f7ee76c6ef5a48aebab1a278ad78f42619, whichever matches your release line, or a later version.
  2. Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
  3. Update Linux Kernel to 5.10.227 or 5.15.168 or 6.1.113 or 6.6.55, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, 4ac58f7734937f3249da734ede946dfb3b1af5e4; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, 3126ccde51f51b0648c8cdccaf916e8bd062e972; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, fd026b6b6758d5569705c02540b40f3bbf822b9a; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, e7ae14f7ee76c6ef5a48aebab1a278ad78f42619; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, 0c238da83f56bb895cab1e5851d034ac45b158d1; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, 4218b31ecc7af7e191768d32e32ed4386d8f9b76; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, a9603a6f75df2fd8125cd208c98cfaa0fe3f7505; b40c2e665cd552eae5fbdbb878bc29a34357668e up to, but not including, 95accb7183badca387f7a8d19a2475cf3089f148; and 2 more ranges4ac58f7734937f3249da734ede946dfb3b1af5e4, 3126ccde51f51b0648c8cdccaf916e8bd062e972, fd026b6b6758d5569705c02540b40f3bbf822b9a, e7ae14f7ee76c6ef5a48aebab1a278ad78f42619, 0c238da83f56bb895cab1e5851d034ac45b158d1, 4218b31ecc7af7e191768d32e32ed4386d8f9b76
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
LinuxLinux Kernelbefore 5.10.227; 5.11 up to, but not including, 5.15.168; 5.16 up to, but not including, 6.1.113; 6.2 up to, but not including, 6.6.55; 6.7 up to, but not including, 6.10.14; 6.11 up to, but not including, 6.11.35.10.227, 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uaf in dbFreeBits [syzbot reported] ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 Read of size 8 at addr ffff8880229254b0 by task syz-executor357/5216 CPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __mutex_lock_common kernel/locking/mutex.c:587 [inline] __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409 dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100 jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 Freed by task 5218: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kfree+0x149/0x360 mm/slub.c:4594 dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278 jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247 jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454 reconfigure_super+0x445/0x880 fs/super.c:1083 vfs_cmd_reconfigure fs/fsopen.c:263 [inline] vfs_fsconfig_locked fs/fsopen.c:292 [inline] __do_sys_fsconfig fs/fsopen.c:473 [inline] __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [Analysis] There are two paths (dbUnmount and jfs_ioc_trim) that generate race condition when accessing bmap, which leads to the occurrence of uaf. Use the lock s_umount to synchronize them, in order to avoid uaf caused by race condition.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.