PT-2024-32201 · Linux+1 · Linux Kernel+1

Published 2024-08-16 · Updated 2024-11-20 · CVE-2024-46789

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.11.0-rc3-dirty #1

Description The vulnerability occurs when CONFIG MEMCG, CONFIG KFENCE, and CONFIG KMEMLEAK are enabled, leading to a warning due to an empty obj ext in the mem pool free function. This happens because the kfence alloc function assigns a value to slab->obj exts in kfence init pool, but the alloc tag add function is not called due to a check in the prepare slab obj exts hook function. As a result, ref->ct remains NULL, causing the warning when mem pool free is called.

Recommendations To resolve this issue, add corresponding checks in the alloc tagging slab free hook function for the s->flags value. This will prevent the warning from occurring when mem pool free is called.

Note: The provided information does not specify the exact version that contains the fix for this vulnerability. Therefore, it is recommended to update to the latest version of the Linux kernel to ensure you have the latest security patches.

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-05927

CVE-2024-46789

Affected Products

Astra Linux

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46789.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-46789 · Vendor Advisory
• https://git.kernel.org/stable/c/ab7ca09520e9c41c219a4427fe0dae24024bfe7f · Patch
• https://osv.dev/vulnerability/CVE-2024-46789 · Vendor Advisory
• https://git.kernel.org/stable/c/2d476c86ba4745fcbc912ce4627df4fa80caa9ad · Patch
• https://cve.org/CVERecord?id=CVE-2024-46789 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-46789 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-46789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46789 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-46789 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46789 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05927 · Security Note
• https://twitter.com/UndercodeNews/status/1859319182422167788 · Twitter Post
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.10 · Note
• https://twitter.com/CVEnew/status/1836306387850141828 · Twitter Post