SB2024123099 - Use-after-free in Linux kernel hfsplus
Published: December 30, 2024 Updated: May 12, 2025
Security Bulletin ID
SB2024123099
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2024-56548)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the hfsplus_read_wrapper() function in fs/hfsplus/wrapper.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/06cbfbb13ac88f4154c2eb4bc4176f9d10139847
- https://git.kernel.org/stable/c/1c82587cb57687de3f18ab4b98a8850c789bedcf
- https://git.kernel.org/stable/c/21900e8478126ff6afe3b66679f676e74d1f8830
- https://git.kernel.org/stable/c/2667c9b7b76efcbc7adbfea249892f20c313b0da
- https://git.kernel.org/stable/c/3d7bda75e1a6239db053c73acde17ca146317824
- https://git.kernel.org/stable/c/baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8
- https://git.kernel.org/stable/c/bfeecda050aa9376f642d5b2a71c4112cc6c8216
- https://git.kernel.org/stable/c/e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866
- https://git.kernel.org/stable/c/f57725bcc5816425e25218fdf5fb6923bc578cdf
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.287