Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2024-46740 | First vendor Publication | 2024-09-18 |
| Vendor | Cve | Last vendor Modification | 2024-09-20 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | |||
|---|---|---|---|
| Overall CVSS Score | 7.8 | ||
| Base Score | 7.8 | Environmental Score | 7.8 |
| impact SubScore | 5.9 | Temporal Score | 7.8 |
| Exploitabality Sub Score | 1.8 | ||
| Attack Vector | Local | Attack Complexity | Low |
| Privileges Required | Low | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | High |
| Integrity Impact | High | Availability Impact | High |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : | |||
|---|---|---|---|
| Cvss Base Score | N/A | Attack Range | N/A |
| Cvss Impact Score | N/A | Attack Complexity | N/A |
| Cvss Expoit Score | N/A | Authentication | N/A |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Allocated by task 743: Freed by task 745: To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46740 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-416 | Use After Free |
CPE : Common Platform Enumeration
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2025-01-08 03:05:17 |
|
| 2025-01-07 03:04:50 |
|
| 2024-12-25 03:03:28 |
|
| 2024-12-12 03:06:24 |
|
| 2024-11-23 03:03:24 |
|
| 2024-11-22 03:01:34 |
|
| 2024-11-20 02:59:54 |
|
| 2024-11-14 03:00:12 |
|
| 2024-11-09 03:00:12 |
|
| 2024-10-26 02:57:35 |
|
| 2024-10-25 02:59:27 |
|
| 2024-10-23 02:58:39 |
|
| 2024-10-03 02:53:49 |
|
| 2024-10-02 02:52:12 |
|
| 2024-09-21 05:27:41 |
|
| 2024-09-20 17:27:28 |
|
| 2024-09-18 13:27:29 |
|
