PT-2024-32754 · Linux+8 · Linux Kernel+8
Published
2024-09-02
·
Updated
2025-11-18
·
CVE-2024-47706
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.58
Description
The issue is related to a possible use-after-free (UAF) vulnerability in the block, bfq (Budget Fair Queueing) module of the Linux kernel. This vulnerability can occur when a process attempts to access a merged bfqq (block fair queueing queue) after it has been freed. The problem arises from the current code's failure to correctly handle the merge chain, leading to a situation where a bfqq is thought to be owned by a BIC (Block IO Controller) when it is not. This can result in a UAF error when the bfqq is accessed after being freed.
Technical details about exploitation include:
- The
bfq insert requestfunction is involved in the vulnerability, specifically when it attempts to get a bfqq from a BIC and then handle IO by the bfqq. - The
bfqq->bicvariable is set incorrectly, leading to the UAF issue. - The
bfq do early stable mergeandbfq do or sched stable mergefunctions are also implicated in the vulnerability.
Recommendations
- Update the Linux kernel to version 6.6.58 or later to fix the vulnerability.
- As a temporary workaround, consider disabling the
bfqmodule until a patch is available. - Restrict access to the vulnerable
bfqmodule to minimize the risk of exploitation.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu