CyberSecBulletin
CVE-2024-49982NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-49982 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 12f7b89dd72b25da4eeaa22097877963cad6418e, a786265aecf39015418e4f930cc1c14603a01490, f63461af2c1a86af4217910e47a5c46e3372e645 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.38% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 12f7b89dd72b25da4eeaa22097877963cad6418e or a786265aecf39015418e4f930cc1c14603a01490 or f63461af2c1a86af4217910e47a5c46e3372e645 or 07b418d50ccbbca7e5d87a3a0d41d436cefebf79, whichever matches your release line, or a later version.
  2. Update SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to V3.1.5 or a later version.
  3. Update SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to V3.1.5 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxad80c34944d7175fa1f5c7a55066020002921a99 up to, but not including, 12f7b89dd72b25da4eeaa22097877963cad6418e; 1a54aa506b3b2f31496731039e49778f54eee881 up to, but not including, a786265aecf39015418e4f930cc1c14603a01490; faf0b4c5e00bb680e8e43ac936df24d3f48c8e65 up to, but not including, f63461af2c1a86af4217910e47a5c46e3372e645; 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4 up to, but not including, 07b418d50ccbbca7e5d87a3a0d41d436cefebf79; 74ca3ef68d2f449bc848c0a814cefc487bf755fa up to, but not including, bc2cbf7525ac288e07d465f5a1d8cb8fb9599254; eb48680b0255a9e8a9bdc93d6a55b11c31262e62 up to, but not including, acc5103a0a8c200a52af7d732c36a8477436a3d3; f98364e926626c678fb4b9004b75cacf92ff0662 up to, but not including, 89d9a69ae0c667e4d9d028028e2dcc837bae626f; f98364e926626c678fb4b9004b75cacf92ff0662 up to, but not including, 8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58; and 12 more ranges12f7b89dd72b25da4eeaa22097877963cad6418e, a786265aecf39015418e4f930cc1c14603a01490, f63461af2c1a86af4217910e47a5c46e3372e645, 07b418d50ccbbca7e5d87a3a0d41d436cefebf79, bc2cbf7525ac288e07d465f5a1d8cb8fb9599254, acc5103a0a8c200a52af7d732c36a8477436a3d3
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensRUGGEDCOM RST2428Pbefore V3.2V3.2
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familybefore V3.2V3.2
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 familybefore V3.2V3.2
LinuxLinux Kernel5.10.214 up to, but not including, 5.10.227; 5.15.153 up to, but not including, 5.15.168; 6.1.83 up to, but not including, 6.1.113; 6.6.23 up to, but not including, 6.6.55; 6.7.11 up to, but not including, 6.8.2; 6.9 up to, but not including, 6.10.14; 6.11 up to, but not including, 6.11.3; 4.19.311; and 2 more ranges5.10.227, 5.15.168, 6.1.113, 6.6.55, 6.8.2, 6.10.14

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.8HighCNA
CVSS 3.17.8HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.