Vulnerability identifier: #VU90180

Vulnerability risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27052

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rtl8xxxu_stop() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/dddedfa3b29a63c2ca4336663806a6128b8545b4
http://git.kernel.org/stable/c/ac512507ac89c01ed6cd4ca53032f52cdb23ea59
http://git.kernel.org/stable/c/3518cea837de4d106efa84ddac18a07b6de1384e
http://git.kernel.org/stable/c/156012667b85ca7305cb363790d3ae8519a6f41e
http://git.kernel.org/stable/c/7059cdb69f8e1a2707dd1e2f363348b507ed7707
http://git.kernel.org/stable/c/58fe3bbddfec10c6b216096d8c0e517cd8463e3a
http://git.kernel.org/stable/c/1213acb478a7181cd73eeaf00db430f1e45b1361

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.