CVE-2024-46762
MEDIUM EPSS 14.7%
Published Sep 18, 20241y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published Sep 18, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Fix possible access to a freed kirqfd instance Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd created and added to the irqfds_list by privcmd_irqfd_assign() may get removed by another thread executing privcmd_irqfd_deassign(), while the former is still using it after dropping the locks. This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops. Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
14.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-416 Use After Free Memory Safety
Affected Products 2
References 3
- git.kernel.org https://git.kernel.org/stable/c/112fd2f02b308564724b8e81006c254d20945c4b
- git.kernel.org https://git.kernel.org/stable/c/611ff1b1ae989a7bcce3e2a8e132ee30e968c557
- git.kernel.org https://git.kernel.org/stable/c/e997b357b13a7d95de31681fc54fcc34235fa527
Remediation
- git.kernel.org https://git.kernel.org/stable/c/112fd2f02b308564724b8e81006c254d20945c4b
- git.kernel.org https://git.kernel.org/stable/c/611ff1b1ae989a7bcce3e2a8e132ee30e968c557
- git.kernel.org https://git.kernel.org/stable/c/e997b357b13a7d95de31681fc54fcc34235fa527