#VU102192 Double free in Linux kernel - CVE-2024-56704

Vulnerability identifier: #VU102192

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56704

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the xen_9pfs_front_free() function in net/9p/trans_xen.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/2bb3ee1bf237557daea1d58007d2e1d4a6502ccf
https://git.kernel.org/stable/c/4950408793b118cb8075bcee1f033b543fb719fa
https://git.kernel.org/stable/c/530bc9f03a102fac95b07cda513bfc16ff69e0ee
https://git.kernel.org/stable/c/692eb06703afc3e24d889d77e94a0e20229f6a4a
https://git.kernel.org/stable/c/7f5a2ed5c1810661e6b03f5a4ebf17682cdea850
https://git.kernel.org/stable/c/b9e26059664bd9ebc64a0e8f5216266fc9f84265
https://git.kernel.org/stable/c/d74b4b297097bd361b8a9abfde9b521ff464ea9c
https://git.kernel.org/stable/c/d888f5f5d76b2722c267e6bdf51d445d60647b7b
https://git.kernel.org/stable/c/e43c608f40c065b30964f0a806348062991b802d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.