#VU102057 Use-after-free in Linux kernel - CVE-2024-53174

Vulnerability identifier: #VU102057

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53174

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the c_show() function in net/sunrpc/cache.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/02999e135b013d85c6df738746e8e24699befee4
https://git.kernel.org/stable/c/068c0b50f3f700b94f78850834cd91ae3b34c2c1
https://git.kernel.org/stable/c/2862eee078a4d2d1f584e7f24fa50dddfa5f3471
https://git.kernel.org/stable/c/acfaf37888e0f0732fb6a50ff093dce6d99994d0
https://git.kernel.org/stable/c/c7dac3af57e38b2054f990e573256d90bf887958
https://git.kernel.org/stable/c/d882e2b7fad3f5e5fac66184a347f408813f654a
https://git.kernel.org/stable/c/e9be26735d055c42543a4d047a769cc6d0fb1504
https://git.kernel.org/stable/c/ec305f303bf070b4f6896b7a76009f702956d402

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.