Executive Summary

Informations
Name CVE-2024-46786 First vendor Publication 2024-09-18
Vendor Cve Last vendor Modification 2024-09-26

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 7.8
Base Score 7.8 Environmental Score 7.8
impact SubScore 5.9 Temporal Score 7.8
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

In the Linux kernel, the following vulnerability has been resolved:

fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF

The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows:

================================================================== BUG: unable to handle page fault for address: fffffbfff803c9e9
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace:

tmigr_handle_remote_up+0x627/0x810
__walk_groups.isra.0+0x47/0x140
tmigr_handle_remote+0x1fa/0x2f0
handle_softirqs+0x180/0x590
irq_exit_rcu+0x84/0xb0
sysvec_apic_timer_interrupt+0x6e/0x90


asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20
default_idle_call+0x38/0x60
do_idle+0x2b5/0x300
cpu_startup_entry+0x54/0x60
start_secondary+0x20d/0x280
common_startup_64+0x13e/0x148
Modules linked in: [last unloaded: netfs] ==================================================================

Therefore delete fscache_cookie_lru_timer when removing the fscahe module.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46786

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-416 Use After Free

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8
Os 3676

Sources (Detail)

https://git.kernel.org/stable/c/0a11262549ac2ac6fb98c7cd40a67136817e5a52
https://git.kernel.org/stable/c/72a6e22c604c95ddb3b10b5d3bb85b6ff4dbc34f
https://git.kernel.org/stable/c/e0d724932ad12e3528f4ce97fc0f6078d0cce4bc
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Date Informations
2025-03-29 03:40:38
  • Multiple Updates
2025-03-28 13:45:02
  • Multiple Updates
2025-03-28 03:18:44
  • Multiple Updates
2025-03-19 03:14:03
  • Multiple Updates
2025-03-18 03:27:00
  • Multiple Updates
2025-03-14 03:14:17
  • Multiple Updates
2025-03-06 14:10:49
  • Multiple Updates
2025-02-22 03:24:23
  • Multiple Updates
2025-01-08 03:05:23
  • Multiple Updates
2025-01-07 03:04:56
  • Multiple Updates
2024-12-25 03:03:34
  • Multiple Updates
2024-12-12 03:06:30
  • Multiple Updates
2024-11-23 03:03:28
  • Multiple Updates
2024-11-22 03:01:38
  • Multiple Updates
2024-11-20 02:59:58
  • Multiple Updates
2024-11-14 03:00:16
  • Multiple Updates
2024-11-09 03:00:16
  • Multiple Updates
2024-10-26 02:57:39
  • Multiple Updates
2024-10-25 02:59:31
  • Multiple Updates
2024-10-23 02:58:43
  • Multiple Updates
2024-10-02 17:27:39
  • Multiple Updates
2024-10-02 00:27:47
  • Multiple Updates
2024-09-26 17:27:39
  • Multiple Updates
2024-09-20 17:27:28
  • Multiple Updates
2024-09-18 13:27:29
  • First insertion