#VU97252 Use-after-free in Linux kernel - CVE-2024-46674

Vulnerability identifier: #VU97252

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46674

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the st_dwc3_probe() and reset_control_assert() functions in drivers/usb/dwc3/dwc3-st.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c
https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1
https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada
https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d
https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18
https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49
https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90
https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.