#VU96843 Use-after-free in Linux kernel - CVE-2024-45003

Vulnerability identifier: #VU96843

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45003

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the inode_lru_list_del(), evict() and inode_lru_isolate() functions in fs/inode.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/3525ad25240dfdd8c78f3470911ed10aa727aa72
https://git.kernel.org/stable/c/03880af02a78bc9a98b5a581f529cf709c88a9b8
https://git.kernel.org/stable/c/cda54ec82c0f9d05393242b20b13f69b083f7e88
https://git.kernel.org/stable/c/437741eba63bf4e437e2beb5583f8633556a2b98
https://git.kernel.org/stable/c/b9bda5f6012dd00372f3a06a82ed8971a4c57c32
https://git.kernel.org/stable/c/9063ab49c11e9518a3f2352434bb276cc8134c5f
https://git.kernel.org/stable/c/2a0629834cd82f05d424bbc193374f9a43d1f87d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.