Use-after-free in Linux kernel - CVE-2024-40947

Detailed vulnerability description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smack_post_notification() function in security/smack/smack_lsm.c, within the selinux_audit_rule_free() and selinux_audit_rule_init() functions in security/selinux/ss/services.c, within the security_key_getsecurity() function in security/security.c, within the ima_free_rule(), ima_lsm_copy_rule(), ima_lsm_update_rule() and ima_lsm_rule_init() functions in security/integrity/ima/ima_policy.c, within the aa_audit_rule_free() and aa_audit_rule_init() functions in security/apparmor/audit.c, within the audit_data_to_entry() and audit_dupe_lsm_field() functions in kernel/auditfilter.c. A local user can escalate privileges on the system.

How to mitigate CVE-2024-40947

Sources

• https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0
• https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88
• https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9c
• https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.222
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.163
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.98
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.39