#VU97251 Use-after-free in Linux kernel - CVE-2024-46673

Vulnerability identifier: #VU97251

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46673

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the aac_init_adapter() function in drivers/scsi/aacraid/comminit.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/d237c7d06ffddcdb5d36948c527dc01284388218
https://git.kernel.org/stable/c/564e1986b00c5f05d75342f8407f75f0a17b94df
https://git.kernel.org/stable/c/9e96dea7eff6f2bbcd0b42a098012fc66af9eb69
https://git.kernel.org/stable/c/85449b28ff6a89c4513115e43ddcad949b5890c9
https://git.kernel.org/stable/c/60962c3d8e18e5d8dfa16df788974dd7f35bd87a
https://git.kernel.org/stable/c/8a3995a3ffeca280a961b59f5c99843d81b15929
https://git.kernel.org/stable/c/4b540ec7c0045c2d01c4e479f34bbc8f147afa4c
https://git.kernel.org/stable/c/919ddf8336f0b84c0453bac583808c9f165a85c2

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.