CVE-2024-0562 — Use After Free in Kernel
Severity
7.8HIGHNVD
EPSS
0.0%
top 96.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 15
Description
A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages2 packages
Also affects: Enterprise Linux 8.0, 9.0
Patches
🔴Vulnerability Details
3📋Vendor Advisories
3Microsoft▶
Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c↗2024-01-09
Debian▶
CVE-2024-0562: linux - A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi...↗2024
Red Hat▶
kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c↗2023-03-10
💬Community
1Bugzilla▶
CVE-2024-0562 kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c↗2024-01-15