CVE-2024-47675

HIGH EPSS 14.6%

Published Oct 21, 20241y ago · Modified Jun 17, 20262w ago

7.8 CVSS 3.1

High

Published Oct 21, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the error_free label and frees the array of bpf_uprobe's without calling bpf_uprobe_unregister(). This leaks bpf_uprobe->uprobe and worse, this frees bpf_uprobe->consumer without removing it from the uprobe->consumers list.

CVSS Details

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

14.6% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 3

Vendor	Product	Version	Range
linux	linux_kernel	*	≥6.6 – <6.6.54
linux	linux_kernel	*	≥6.7 – <6.10.13
linux	linux_kernel	*	≥6.11 – <6.11.2

References 4

git.kernel.org https://git.kernel.org/stable/c/5fe6e308abaea082c20fbf2aa5df8e14495622cf

Patch
git.kernel.org https://git.kernel.org/stable/c/790c630ab0e7d7aba6d186581d4627c09fce60f3

Patch
git.kernel.org https://git.kernel.org/stable/c/7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee

Patch
git.kernel.org https://git.kernel.org/stable/c/cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/5fe6e308abaea082c20fbf2aa5df8e14495622cf

Patch
git.kernel.org https://git.kernel.org/stable/c/790c630ab0e7d7aba6d186581d4627c09fce60f3

Patch
git.kernel.org https://git.kernel.org/stable/c/7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee

Patch
git.kernel.org https://git.kernel.org/stable/c/cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c

Patch