PT-2024-7200 · Linux+8 · Linux Kernel+8
Alexandra Winter
·
Published
2024-07-30
·
Updated
2026-03-14
·
CVE-2024-42271
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.50
Description
The vulnerability is related to a use-after-free issue in the
iucv sock close() function. The iucv sever path() function is called from both process context and bh context, and iucv->path is used as an indicator of whether someone else is taking care of severing the path. This needs to be done with atomic compare and swap to prevent a small window where iucv sock close() tries to work with a path that has already been severed and freed. The issue can lead to a kernel panic and potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.50 or later. As a temporary workaround, consider disabling the
iucv sever path() function until a patch is available. Additionally, restricting access to the af iucv module can help minimize the risk of exploitation.Exploit
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu