CVE-2024-40956Use After Free in Linux

CWE-416Use After Free31 documents6 sources
Severity
7.8HIGHNVD
OSV5.5
EPSS
0.0%
top 98.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 12
Latest updateSep 25

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

NVDlinux/linux_kernel5.115.15.162+4
Debianlinux/linux_kernel< 6.1.99-1+2
Ubuntulinux/linux_kernel< 5.15.0-121.131+1
CVEListV5linux/linux16e19e11228ba660d9e322035635e7dcf160d5c21b08bf5a17c66ab7dbb628df5344da53c8e7ab33+5
debiandebian/linux< linux 6.1.99-1 (bookworm)

Patches

🔴Vulnerability Details

15
OSV
linux-azure-fde-5.15 vulnerabilities2024-09-25
OSV
linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities2024-09-23
OSV
linux-hwe-6.82024-09-23
OSV
linux-raspi vulnerabilities2024-09-23
OSV
linux-ibm-5.15, linux-oracle-5.15 vulnerabilities2024-09-23

📋Vendor Advisories

15
Ubuntu
Linux kernel vulnerabilities2024-09-25
Ubuntu
Linux kernel vulnerabilities2024-09-23
Ubuntu
Linux kernel vulnerabilities2024-09-23
Ubuntu
Linux kernel vulnerabilities2024-09-23
Ubuntu
Linux kernel vulnerabilities2024-09-23