Linux: Use After Free
CVE-2024-49950 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 686e05c9dbd68766c6bda5f31f7e077f36a7fb29, b22346eec479a30bfa4a02ad2c551b54809694d0, b90907696c30172b809aa3dd2f0caffae761e4c6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.37% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 686e05c9dbd68766c6bda5f31f7e077f36a7fb29 or b22346eec479a30bfa4a02ad2c551b54809694d0 or b90907696c30172b809aa3dd2f0caffae761e4c6 or 78d30ce16fdf9c301bcd8b83ce613cea079cea83, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.174 or 6.1.118 or 6.6.55 or 6.10.14, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 7b064edae38d62d8587a8c574f93b53ce75ae749 up to, but not including, 686e05c9dbd68766c6bda5f31f7e077f36a7fb29; 7b064edae38d62d8587a8c574f93b53ce75ae749 up to, but not including, b22346eec479a30bfa4a02ad2c551b54809694d0; 7b064edae38d62d8587a8c574f93b53ce75ae749 up to, but not including, b90907696c30172b809aa3dd2f0caffae761e4c6; 7b064edae38d62d8587a8c574f93b53ce75ae749 up to, but not including, 78d30ce16fdf9c301bcd8b83ce613cea079cea83; 7b064edae38d62d8587a8c574f93b53ce75ae749 up to, but not including, a1c6174e23df10b8e5770e82d63bc6e2118a3dc7; 7b064edae38d62d8587a8c574f93b53ce75ae749 up to, but not including, 333b4fd11e89b29c84c269123f871883a30be586; 3.8 | 686e05c9dbd68766c6bda5f31f7e077f36a7fb29, b22346eec479a30bfa4a02ad2c551b54809694d0, b90907696c30172b809aa3dd2f0caffae761e4c6, 78d30ce16fdf9c301bcd8b83ce613cea079cea83, a1c6174e23df10b8e5770e82d63bc6e2118a3dc7, 333b4fd11e89b29c84c269123f871883a30be586 |
| Debian | Debian Linux | 11.0 | Not stated |
| Linux | Linux Kernel | 3.8 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.118; 6.2 up to, but not including, 6.6.55; 6.7 up to, but not including, 6.10.14; 6.11 up to, but not including, 6.11.3 | 5.15.174, 6.1.118, 6.6.55, 6.10.14, 6.11.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci2 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline] l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline] hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ... Freed by task 5245: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2256 [inline] slab_free mm/slub.c:4477 [inline] kfree+0x12a/0x3b0 mm/slub.c:4598 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline] l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline] hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/333b4fd11e89b29c84c269123f871883a30be586
- git.kernel.org/stable/c/686e05c9dbd68766c6bda5f31f7e077f36a7fb29
- git.kernel.org/stable/c/78d30ce16fdf9c301bcd8b83ce613cea079cea83
- git.kernel.org/stable/c/a1c6174e23df10b8e5770e82d63bc6e2118a3dc7
- git.kernel.org/stable/c/b22346eec479a30bfa4a02ad2c551b54809694d0
- git.kernel.org/stable/c/b90907696c30172b809aa3dd2f0caffae761e4c6
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlMailing List, Third Party Advisory
Recent Use After Free vulnerabilities
- 7.0 High severity
- 7.0 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.