CVE-2024-0775

2024-01-2213:15:25

CWE-416

[email protected]

web.nvd.nist.gov

use-after-free

ext4

remount

information leak

quota

local user

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

5.1%

JSON

A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.

Affected configurations

Nvd

Node

linuxlinux_kernelRange<6.4

linuxlinux_kernelMatch6.4rc1

Node

redhatenterprise_linuxMatch9.0

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linuxlinux_kernel6.4cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*
redhatenterprise_linux9.0cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	6.4	cpe:2.3:o:linux:linux_kernel:6.4:rc1::::::
redhat	enterprise_linux	9.0	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*