CVE-2024-0582High· 7.8▾ MidnightPoC availableA memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 2.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
13%
8 GitHub repos (last check)
A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system.
kernel (all versions)kernelkernelkernel-rtkernelkernel-rtkernelkernel-rtRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-0193High· 7.8Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation
CVE-2024-0562High· 7.8Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c
CVE-2023-3397High· 7.0Kernel: slab-use-after-free write in txend due to race condition
CVE-2023-6270High· 7.0Kernel: aoe: improper reference count leads to use-after-free vulnerability
CVE-2023-1118High· 7.8A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device
CVE-2021-4204NoneAn out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation