PT-2024-9313 · Linux+5 · Linux Kernel+5
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a use-after-free vulnerability in the cachefiles component of the Linux kernel. This vulnerability can be exploited to potentially elevate privileges. The vulnerability occurs when requests are not properly removed from the cache during flushing, allowing for the possibility of accessing freed requests. The
cachefiles flush reqs function is involved in this issue, and the req->msg.opcode is checked against CACHEFILES OP READ. The vulnerability can be exploited due to a concurrency issue between daemon thread1 and daemon thread2, where a request may be used after it has been freed.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu