CVE-2024-42271Use After Free in Linux

CWE-416Use After Free54 documents7 sources
Severity
7.8HIGHNVD
OSV8.8OSV7.1OSV5.5
EPSS
0.0%
top 97.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 17
Latest updateJan 9

Description

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path (or it is already removed / never existed). This needs to be done with atomic compare and swap, otherwise there is a small window where iucv_sock_close() will try to work with a path that has already been severed and fre

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages14 packages

Patches

🔴Vulnerability Details

26
OSV
linux-azure-5.15 vulnerabilities2025-01-09
OSV
linux-gkeop vulnerabilities2024-12-12
OSV
linux-intel-iotg, linux-intel-iotg-5.15 vulnerabilities2024-12-09
OSV
linux-azure vulnerabilities2024-11-20
OSV
linux-iot vulnerabilities2024-11-19

📋Vendor Advisories

27
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel (GKE) vulnerabilities2024-12-12
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities2024-12-09
Ubuntu
Linux kernel (Azure) vulnerabilities2024-11-20
Ubuntu
Linux kernel (IoT) vulnerabilities2024-11-19
CVE-2024-42271 — Use After Free in Linux | cvebase