CVE-2024-46786

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows: ==================================================================...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 12bb21a29c19aae50cfad4e2bb5c943108f34a7d < c1fc36d5470335546c45799d94d7bb2cbc09e8b7, >= 12bb21a29c19aae50cfad4e2bb5c943108f34a7d < e0d724932ad12e3528f4ce97fc0f6078d0cce4bc, >= 12bb21a29c19aae50cfad4e2bb5c943108f34a7d < 0a11262549ac2ac6fb98c7cd40a67136817e5a52, >= 12bb21a29c19aae50cfad4e2bb5c943108f34a7d < 72a6e22c604c95ddb3b10b5d3bb85b6ff4dbc34f, >= 5.17, >= V3.1.6, >= 5.17 < 6.1.160, >= 6.2 < 6.6.51, >= 6.7 < 6.10.10, 6.11

Fixed versions

6.1.160, 6.6.51, 6.10.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416