#VU105391 Use-after-free in Linux kernel - CVE-2024-58083

Vulnerability identifier: #VU105391

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58083

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the include/linux/kvm_host.h. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/125da53b3c0c9d7f58353aea0076e9efd6498ba7
https://git.kernel.org/stable/c/1e7381f3617d14b3c11da80ff5f8a93ab14cfc46
https://git.kernel.org/stable/c/ca8da90ed1432ff3d000de4f1e2275d4e7d21b96
https://git.kernel.org/stable/c/d817e510662fd1c9797952408d94806f97a5fffd
https://git.kernel.org/stable/c/f2f805ada63b536bc192458a7098388286568ad4

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.