CVE-2024-47675CWE-416

CVE-2024-47675

High · published October 21, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()

If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the

error_free label and frees the array of bpf_uprobe's without calling

bpf_uprobe_unregister().

This leaks bpf_uprobe->uprobe and worse, this frees bpf_uprobe->consumer

without removing it from the uprobe->consumers list.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-416 · Use After Free
Published
2024-10-21T16:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.6, < 6.6.546.6.54
linux/linux_kernel≥ 6.7, < 6.10.136.10.13
linux/linux_kernel≥ 6.11, < 6.11.26.11.2
References (4)
EPSS history
Timeline
  • 21 OCT 11:53Z
    bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
    cvelistv5