CVE-2024-41149
Published: 11 January 2025
Description
In the Linux kernel, the following vulnerability has been resolved: block: avoid to reuse `hctx` not removed from cpuhp callback list If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it, otherwise use-after-free may be triggered.
Security Summary
CVE-2024-41149 is a use-after-free vulnerability in the Linux kernel's block subsystem. It occurs when an 'hctx' (hardware context) is reused without first being removed from the cpuhp callback list, potentially triggering a use-after-free condition. The issue is classified under CWE-416 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could allow the attacker to trigger the use-after-free, potentially leading to arbitrary code execution, data corruption, or system denial of service within the kernel's unchanged security scope.
Mitigation involves applying the relevant stable kernel patches, as detailed in the upstream commit references: 85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b, b5792c162dcf6197bf3d2de2be6c8169435b73d0, and ee18012c80155f6809522804099621070c69ec72. These commits explicitly address the issue by preventing reuse of 'hctx' instances not removed from the cpuhp callback list.
Details
- CWE(s)