#VU102012 Use-after-free in Linux kernel - CVE-2024-56678

Vulnerability identifier: #VU102012

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56678

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ___do_page_fault() function in arch/powerpc/mm/fault.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/06dbbb4d5f7126b6307ab807cbf04ecfc459b933
https://git.kernel.org/stable/c/15f78d2c3d1452645bd8b9da909b0ca266f83c43
https://git.kernel.org/stable/c/4d2655754e94741b159aa807b72ea85518a65fd5
https://git.kernel.org/stable/c/7eaeb7a49b6d16640f9f3c9074c05175d74c710b
https://git.kernel.org/stable/c/9ea8d8bf9b625e8ad3be6b0432aecdc549914121
https://git.kernel.org/stable/c/e0a470b5733c1fe068d5c58b0bb91ad539604bc6

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.