#VU99059 Double free in Linux kernel - CVE-2024-49853

Vulnerability identifier: #VU99059

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49853

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the scmi_optee_chan_free() function in drivers/firmware/arm_scmi/optee.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/d7f4fc2bc101e666da649605a9ece2bd42529c7a
https://git.kernel.org/stable/c/6699567b0bbb378600a4dc0a1f929439a4e84a2c
https://git.kernel.org/stable/c/dc9543a4f2a5498a4a12d6d2427492a6f1a28056
https://git.kernel.org/stable/c/aef6ae124bb3cc12e34430fed91fbb7efd7a444d
https://git.kernel.org/stable/c/e98dba934b2fc587eafb83f47ad64d9053b18ae0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.