CVE-2024-26872 — Use After Free in Linux
Severity
7.0HIGHNVD
OSV6.5OSV5.5
EPSS
0.0%
top 98.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 17
Latest updateJul 26
Description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Do not register event handler until srpt device is fully setup
Upon rare occasions, KASAN reports a use-after-free Write
in srpt_refresh_port().
This seems to be because an event handler is registered before the
srpt device is fully setup and a race condition upon error may leave a
partially setup event handler in place.
Instead, only register the event handler after srpt device initialization
is complete.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9
Affected Packages5 packages
▶CVEListV5linux/linuxa42d985bd5b234da8b61347a78dc3057bf7bb94d — bdd895e0190c464f54f84579e7535d80276f0fc5+7
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
17📋Vendor Advisories
17💬Community
1Bugzilla▶
CVE-2024-26872 kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup↗2024-04-17