CyberSecBulletin
CVE-2024-56693NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2024-56693 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 41219c147df8bbd6591f59af5d695fb6c9a1cbff, 259bf925583ec9e3781df778cadf00594095090d, 410896624db639500f24f46478b4bfa05c76bf56 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 41219c147df8bbd6591f59af5d695fb6c9a1cbff or 259bf925583ec9e3781df778cadf00594095090d or 410896624db639500f24f46478b4bfa05c76bf56 or c0c2744cd2939ec5999c51dbaf2af16886548b7b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.174 or 6.1.120 or 6.6.64 or 6.11.11, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux7f9b348cb5e94259acdcbafbcaed55d3bb515304 up to, but not including, 41219c147df8bbd6591f59af5d695fb6c9a1cbff; 7f9b348cb5e94259acdcbafbcaed55d3bb515304 up to, but not including, 259bf925583ec9e3781df778cadf00594095090d; 7f9b348cb5e94259acdcbafbcaed55d3bb515304 up to, but not including, 410896624db639500f24f46478b4bfa05c76bf56; 7f9b348cb5e94259acdcbafbcaed55d3bb515304 up to, but not including, c0c2744cd2939ec5999c51dbaf2af16886548b7b; 7f9b348cb5e94259acdcbafbcaed55d3bb515304 up to, but not including, 63dfd728b30f79495dacc886127695a379805152; 7f9b348cb5e94259acdcbafbcaed55d3bb515304 up to, but not including, 826cc42adf44930a633d11a5993676d85ddb0842; 5.1441219c147df8bbd6591f59af5d695fb6c9a1cbff, 259bf925583ec9e3781df778cadf00594095090d, 410896624db639500f24f46478b4bfa05c76bf56, c0c2744cd2939ec5999c51dbaf2af16886548b7b, 63dfd728b30f79495dacc886127695a379805152, 826cc42adf44930a633d11a5993676d85ddb0842
LinuxLinux Kernel5.14 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.120; 6.2 up to, but not including, 6.6.64; 6.7 up to, but not including, 6.11.11; 6.12 up to, but not including, 6.12.25.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open(). brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case: case 1: T1: modprobe brd brd_init brd_alloc(0) // success add_disk disk_scan_partitions bdev_file_open_by_dev // alloc file fput // won't free until back to userspace brd_alloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace __fput blkdev_release bdev_release blkdev_put_whole bdev->bd_disk->fops->release // fops is freed now, UAF! case 2: T1: T2: modprobe brd brd_init brd_alloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->release Fix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.