CyberSecBulletin
CVE-2024-56678NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-56678 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e0a470b5733c1fe068d5c58b0bb91ad539604bc6, 4d2655754e94741b159aa807b72ea85518a65fd5, 9ea8d8bf9b625e8ad3be6b0432aecdc549914121 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.23% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to e0a470b5733c1fe068d5c58b0bb91ad539604bc6 or 4d2655754e94741b159aa807b72ea85518a65fd5 or 9ea8d8bf9b625e8ad3be6b0432aecdc549914121 or 7eaeb7a49b6d16640f9f3c9074c05175d74c710b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.174 or 6.1.120 or 6.6.64 or 6.11.11, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux90cbac0e995dd92f7bcf82f74aa50250bf194a4a up to, but not including, e0a470b5733c1fe068d5c58b0bb91ad539604bc6; 90cbac0e995dd92f7bcf82f74aa50250bf194a4a up to, but not including, 4d2655754e94741b159aa807b72ea85518a65fd5; 90cbac0e995dd92f7bcf82f74aa50250bf194a4a up to, but not including, 9ea8d8bf9b625e8ad3be6b0432aecdc549914121; 90cbac0e995dd92f7bcf82f74aa50250bf194a4a up to, but not including, 7eaeb7a49b6d16640f9f3c9074c05175d74c710b; 90cbac0e995dd92f7bcf82f74aa50250bf194a4a up to, but not including, 15f78d2c3d1452645bd8b9da909b0ca266f83c43; 90cbac0e995dd92f7bcf82f74aa50250bf194a4a up to, but not including, 06dbbb4d5f7126b6307ab807cbf04ecfc459b933; 5.13e0a470b5733c1fe068d5c58b0bb91ad539604bc6, 4d2655754e94741b159aa807b72ea85518a65fd5, 9ea8d8bf9b625e8ad3be6b0432aecdc549914121, 7eaeb7a49b6d16640f9f3c9074c05175d74c710b, 15f78d2c3d1452645bd8b9da909b0ca266f83c43, 06dbbb4d5f7126b6307ab807cbf04ecfc459b933
LinuxLinux Kernel5.13 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.120; 6.2 up to, but not including, 6.6.64; 6.7 up to, but not including, 6.11.11; 6.12 up to, but not including, 6.12.25.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/fault: Fix kfence page fault reporting copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copy_from_kernel_nofault() can cause page faults. Since *_nofault() functions define their own fixup table for handling fault, use that instead of asking kfence to handle such faults. Hence we search the exception tables for the nip which generated the fault. If there is an entry then we let the fixup table handler handle the page fault by returning an error from within ___do_page_fault(). This can be easily triggered if someone tries to do dd from /proc/kcore. eg. dd if=/proc/kcore of=/dev/null bs=1M Some example false negatives: =============================== BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x9c/0x1a0 Invalid read at 0xc0000000fdff0000: copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec BUG: KFENCE: use-after-free read in copy_from_kernel_nofault+0x9c/0x1a0 Use-after-free read at 0xc0000000fe050000 (in kfence-#2): copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.