Use-after-free in Linux kernel - CVE-2024-53097

Vulnerability identifier: #VU100937

CSH Severity: Low

CVSS v4 BT: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53097

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __do_krealloc() function in mm/slab_common.c. A local user can escalate privileges on the system.

Linux kernel
Ubuntu
openEuler
IBM DataPower Gateway
Red Hat OpenShift Dev Spaces
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-5.15.0-133-lowlatency (Ubuntu package)
linux-image-5.15.0-133-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-133-generic (Ubuntu package)
linux-image-5.15.0-133-generic-lpae (Ubuntu package)
linux-image-5.15.0-133-generic-64k (Ubuntu package)
linux-image-5.15.0-134-generic-lpae (Ubuntu package)
linux-image-5.15.0-134-generic (Ubuntu package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-oem-20.04c (Ubuntu package)
linux-image-oem-20.04d (Ubuntu package)
linux-image-5.15.0-134-generic-64k (Ubuntu package)
linux-image-5.15.0-1021-nvidia-tegra-igx (Ubuntu package)
linux-image-5.15.0-1021-nvidia-tegra-igx-rt (Ubuntu package)
linux-image-nvidia-tegra-igx-rt (Ubuntu package)
linux-image-nvidia-tegra-igx (Ubuntu package)
linux-image-nvidia-tegra-rt (Ubuntu package)
linux-image-5.15.0-1033-nvidia-tegra (Ubuntu package)
linux-image-nvidia-tegra (Ubuntu package)
linux-image-5.15.0-1033-nvidia-tegra-rt (Ubuntu package)
linux-image-5.15.0-1044-xilinx-zynqmp (Ubuntu package)
linux-image-xilinx-zynqmp (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-5.15.0-1060-gkeop (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-5.15.0-1070-ibm (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-nvidia-lowlatency (Ubuntu package)
linux-image-nvidia (Ubuntu package)
linux-image-5.15.0-1072-nvidia (Ubuntu package)
linux-image-5.15.0-1072-nvidia-lowlatency (Ubuntu package)
linux-image-5.15.0-1072-raspi (Ubuntu package)
linux-image-5.15.0-1073-intel-iotg (Ubuntu package)
linux-image-5.15.0-1074-ibm (Ubuntu package)
linux-image-oracle-lts-22.04 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-5.15.0-1075-gke (Ubuntu package)
linux-image-5.15.0-1075-oracle (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.15.0-1076-kvm (Ubuntu package)
linux-image-gcp-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1077-gcp (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1078-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.15.0-1080-aws (Ubuntu package)
linux-image-azure-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1081-azure (Ubuntu package)
linux-image-5.15.0-1081-azure-fde (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-cvm (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-image-azure-fde-lts-22.04 (Ubuntu package)
bpftool-debuginfo
bpftool
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
kernel
python3-perf-debuginfo
linux-image-intel-iotg (Ubuntu package)
linux-image-intel (Ubuntu package)

Install update from vendor's website.

Linux kernel - update to 5.15.173
IBM DataPower Gateway - update to 10.6.6.0
Red Hat OpenShift Dev Spaces - update to 3.21.0
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.120, 5.15.0.133.143~20.04.1
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.120, 5.15.0.133.143~20.04.1
linux-image-lowlatency-64k (Ubuntu package) - update to 5.15.0.133.120
linux-image-lowlatency (Ubuntu package) - update to 5.15.0.133.120
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.132, 5.15.0.134.145~20.04.1
linux-image-virtual-hwe-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.132, 5.15.0.134.145~20.04.1
linux-image-virtual (Ubuntu package) - update to 5.15.0.133.132
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.132, 5.15.0.134.145~20.04.1
linux-image-generic-lpae (Ubuntu package) - update to 5.15.0.133.132
linux-image-generic-hwe-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.132, 5.15.0.134.145~20.04.1
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - addressed in versions 5.15.0.133.132, 5.15.0.134.145~20.04.1
linux-image-generic-64k (Ubuntu package) - update to 5.15.0.133.132
linux-image-generic (Ubuntu package) - update to 5.15.0.133.132
linux-image-5.15.0-133-lowlatency (Ubuntu package) - addressed in versions 5.15.0-133.143, 5.15.0-133.143~20.04.1
linux-image-5.15.0-133-lowlatency-64k (Ubuntu package) - addressed in versions 5.15.0-133.143, 5.15.0-133.143~20.04.1
linux-image-5.15.0-133-generic (Ubuntu package) - update to 5.15.0-133.144
linux-image-5.15.0-133-generic-lpae (Ubuntu package) - update to 5.15.0-133.144
linux-image-5.15.0-133-generic-64k (Ubuntu package) - update to 5.15.0-133.144
linux-image-5.15.0-134-generic-lpae (Ubuntu package) - update to 5.15.0-134.145~20.04.1
linux-image-5.15.0-134-generic (Ubuntu package) - update to 5.15.0-134.145~20.04.1
linux-image-oem-20.04b (Ubuntu package) - update to 5.15.0.134.145~20.04.1
linux-image-oem-20.04c (Ubuntu package) - update to 5.15.0.134.145~20.04.1
linux-image-oem-20.04d (Ubuntu package) - update to 5.15.0.134.145~20.04.1
linux-image-5.15.0-134-generic-64k (Ubuntu package) - update to 5.15.0-134.145~20.04.1
linux-image-5.15.0-1021-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1021.21
linux-image-5.15.0-1021-nvidia-tegra-igx-rt (Ubuntu package) - update to 5.15.0-1021.21
linux-image-nvidia-tegra-igx-rt (Ubuntu package) - update to 5.15.0.1021.23
linux-image-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0.1021.23
linux-image-nvidia-tegra-rt (Ubuntu package) - update to 5.15.0.1033.33
linux-image-5.15.0-1033-nvidia-tegra (Ubuntu package) - update to 5.15.0-1033.33
linux-image-nvidia-tegra (Ubuntu package) - update to 5.15.0.1033.33
linux-image-5.15.0-1033-nvidia-tegra-rt (Ubuntu package) - update to 5.15.0-1033.33
linux-image-5.15.0-1044-xilinx-zynqmp (Ubuntu package) - update to 5.15.0-1044.48
linux-image-xilinx-zynqmp (Ubuntu package) - update to 5.15.0.1044.48
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1060.59
linux-image-gkeop (Ubuntu package) - update to 5.15.0.1060.59
linux-image-5.15.0-1060-gkeop (Ubuntu package) - update to 5.15.0-1060.68
linux-image-ibm (Ubuntu package) - addressed in versions 5.15.0.1070.66, 5.15.0.1074.77~20.04.1
linux-image-5.15.0-1070-ibm (Ubuntu package) - update to 5.15.0-1070.73
linux-image-raspi-nolpae (Ubuntu package) - update to 5.15.0.1072.70
linux-image-raspi (Ubuntu package) - update to 5.15.0.1072.70
linux-image-nvidia-lowlatency (Ubuntu package) - update to 5.15.0.1072.72
linux-image-nvidia (Ubuntu package) - update to 5.15.0.1072.72
linux-image-5.15.0-1072-nvidia (Ubuntu package) - update to 5.15.0-1072.73
linux-image-5.15.0-1072-nvidia-lowlatency (Ubuntu package) - update to 5.15.0-1072.73
linux-image-5.15.0-1072-raspi (Ubuntu package) - update to 5.15.0-1072.75
linux-image-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1073.73, 5.15.0.1073.79~20.04.2
linux-image-5.15.0-1073-intel-iotg (Ubuntu package) - addressed in versions 5.15.0-1073.79, 5.15.0-1073.79~20.04.2
linux-image-intel (Ubuntu package) - update to 5.15.0.1073.79~20.04.2
linux-image-5.15.0-1074-ibm (Ubuntu package) - update to 5.15.0-1074.77~20.04.1
linux-image-oracle-lts-22.04 (Ubuntu package) - update to 5.15.0.1075.71
linux-image-gke (Ubuntu package) - update to 5.15.0.1075.74
linux-image-gke-5.15 (Ubuntu package) - update to 5.15.0.1075.74
linux-image-5.15.0-1075-gke (Ubuntu package) - update to 5.15.0-1075.81
linux-image-5.15.0-1075-oracle (Ubuntu package) - addressed in versions 5.15.0-1075.81, 5.15.0-1075.81~20.04.1
linux-image-oracle (Ubuntu package) - update to 5.15.0.1075.81~20.04.1
linux-image-kvm (Ubuntu package) - update to 5.15.0.1076.72
linux-image-5.15.0-1076-kvm (Ubuntu package) - update to 5.15.0-1076.81
linux-image-gcp-lts-22.04 (Ubuntu package) - update to 5.15.0.1077.73
linux-image-5.15.0-1077-gcp (Ubuntu package) - addressed in versions 5.15.0-1077.86, 5.15.0-1077.86~20.04.1
linux-image-gcp (Ubuntu package) - update to 5.15.0.1077.86~20.04.1
linux-image-aws-lts-22.04 (Ubuntu package) - update to 5.15.0.1078.80
linux-image-5.15.0-1078-aws (Ubuntu package) - update to 5.15.0-1078.85
linux-image-aws (Ubuntu package) - update to 5.15.0.1080.87~20.04.1
linux-image-5.15.0-1080-aws (Ubuntu package) - update to 5.15.0-1080.87~20.04.1
linux-image-azure-lts-22.04 (Ubuntu package) - update to 5.15.0.1081.79
linux-image-5.15.0-1081-azure (Ubuntu package) - addressed in versions 5.15.0-1081.90, 5.15.0-1081.90~20.04.1
linux-image-5.15.0-1081-azure-fde (Ubuntu package) - addressed in versions 5.15.0-1081.90.1, 5.15.0-1081.90~20.04.1.1
linux-image-azure (Ubuntu package) - update to 5.15.0.1081.90~20.04.1
linux-image-azure-cvm (Ubuntu package) - update to 5.15.0.1081.90~20.04.1
linux-image-azure-fde (Ubuntu package) - update to 5.15.0.1081.90~20.04.1.57
linux-image-azure-fde-lts-22.04 (Ubuntu package) - update to 5.15.0.1081.90.58
bpftool-debuginfo - update to 6.6.0-76.0.0.69
bpftool - update to 6.6.0-76.0.0.69
kernel-debuginfo - update to 6.6.0-76.0.0.69
kernel-debugsource - update to 6.6.0-76.0.0.69
kernel-devel - update to 6.6.0-76.0.0.69
kernel-headers - update to 6.6.0-76.0.0.69
kernel-source - update to 6.6.0-76.0.0.69
kernel-tools - update to 6.6.0-76.0.0.69
kernel-tools-debuginfo - update to 6.6.0-76.0.0.69
kernel-tools-devel - update to 6.6.0-76.0.0.69
perf - update to 6.6.0-76.0.0.69
perf-debuginfo - update to 6.6.0-76.0.0.69
python3-perf - update to 6.6.0-76.0.0.69
kernel - update to 6.6.0-76.0.0.69
python3-perf-debuginfo - update to 6.6.0-76.0.0.69

• https://git.kernel.org/stable/c/3dfb40da84f26dd35dd9bbaf626a2424565b8406
• https://git.kernel.org/stable/c/486aeb5f1855c75dd810c25036134961bd2a6722
• https://git.kernel.org/stable/c/704573851b51808b45dae2d62059d1d8189138a2
• https://git.kernel.org/stable/c/71548fada7ee0eb50cc6ccda82dff010c745f92c
• https://git.kernel.org/stable/c/8ebee7565effdeae6085458f8f8463363120a871
• https://git.kernel.org/stable/c/d02492863023431c31f85d570f718433c22b9311
• https://git.kernel.org/stable/c/d43f1430d47c22a0727c05b6f156ed25fecdfeb4
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.173

• Use-after-free in Linux kernel mm
• openEuler 24.03 LTS update for kernel
• Ubuntu update for linux
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-5.15
• Ubuntu update for linux-lowlatency-hwe-5.15
• Ubuntu update for linux-gcp
• Ubuntu update for linux-ibm
• Ubuntu update for linux-raspi
• Ubuntu update for linux-aws
• Ubuntu update for linux-intel-iotg
• Ubuntu update for linux-hwe-5.15
• Ubuntu update for linux-aws-5.15
• Ubuntu update for linux-xilinx-zynqmp
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux-ibm-5.15
• Multiple vulnerabilities in IBM DataPower Gateway
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.21