CVE-2024-46740 — Use After Free in Linux

CWE-416 — Use After Free41 documents9 sources
Severity
7.8HIGHNVD
OSV8.8OSV7.1OSV5.5
EPSS
0.0%
top 96.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
LinuxLinux KernelDebian Linux+10 more
Timeline
PublishedSep 18
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. H…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages15 packages

▶NVDlinux/linux_kernel5.4.226 — 5.4.284+6
▶Debianlinux/linux_kernel< 5.10.226-1+3
▶Ubuntulinux/linux_kernel< 5.4.0-200.220+2

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

19
OSV
linux-azure, linux-azure-6.8 vulnerabilities↗2025-01-09
▶
OSV
linux-azure-5.15 vulnerabilities↗2025-01-09
▶
OSV
linux-hwe-6.8 vulnerabilities↗2025-01-06
▶
OSV
linux-gkeop vulnerabilities↗2024-12-12
▶
OSV
linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities↗2024-12-12
▶

📋Vendor Advisories

21
CISA ICS
Siemens Third-Party Components in SINEC OS↗2025-08-14
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2025-01-09
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2025-01-09
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2025-01-06
▶
Ubuntu
Linux kernel (GKE) vulnerabilities↗2024-12-12
▶
CVE-2024-46740 — Use After Free in Linux | cvebase