PT-2024-35611 · Linux+8 · Linux Kernel+8
Yu Kuai
·
Published
2024-11-29
·
Updated
2026-01-13
·
CVE-2024-53166
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6
Description
A use-after-free vulnerability has been identified in the Linux kernel, specifically in the block, bfq module. The issue arises when the
bfq limit depth() function dereferences bfqq from bic without proper locking, potentially leading to a use-after-free condition if the io context is shared among multiple tasks. This vulnerability can be triggered, for example, by testing bfq with io uring in version 6.6 of the Linux kernel. The vulnerability is related to the bfqq group function and can cause a slab-use-after-free error.Recommendations
To resolve this issue, protect the
bic to bfqq() function with bfqd->lock. This will prevent the use-after-free condition by ensuring that access to bfqq from bic is properly synchronized.Note: The provided information does not specify a fixed version for the vulnerability. Therefore, it is recommended to update to the latest version of the Linux kernel to ensure you have the latest security patches.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu