SB2024111925 - Use-after-free in Linux kernel md driver
Published: November 19, 2024 Updated: May 12, 2025
Security Bulletin ID
SB2024111925
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2024-50280)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the check_migrations(), destroy(), cache_create() and cache_ctr() functions in drivers/md/dm-cache-target.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/5a754d3c771280f2d06bf8ab716d6a0d36ca256e
- https://git.kernel.org/stable/c/8cc12dab635333c4ea28e72d7b947be7d0543c2c
- https://git.kernel.org/stable/c/aee3ecda73ce13af7c3e556383342b57e6bd0718
- https://git.kernel.org/stable/c/135496c208ba26fd68cdef10b64ed7a91ac9a7ff
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.237
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.181
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.117
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.61