#VU90049 Use-after-free in Linux kernel - CVE-2024-36886

Vulnerability identifier: #VU90049

Vulnerability risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-36886

CWE-ID: CWE-416

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a use-after-free error within the tipc_buf_append() function in net/tipc/msg.c when processing fragmented TIPC messages. A remote attacker can send specially crafted packets to the system, trigger a use-after-free error and execute arbitrary code on the system in the context of the kernel.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/e19ec8ab0e25bc4803d7cc91c84e84532e2781bd
https://git.kernel.org/stable/c/93bc2d6d16f2c3178736ba6b845b30475856dc40
https://git.kernel.org/stable/c/367766ff9e407f8a68409b7ce4dc4d5a72afeab1
https://git.kernel.org/stable/c/66116556076f0b96bc1aa9844008c743c8c67684
https://git.kernel.org/stable/c/21ea04aad8a0839b4ec27ef1691ca480620e8e14
https://git.kernel.org/stable/c/ffd4917c1edb3c3ff334fce3704fbe9c39f35682
https://git.kernel.org/stable/c/a0fbb26f8247e326a320e2cb4395bfb234332c90
https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2b
https://www.zerodayinitiative.com/advisories/ZDI-24-821/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.