CVE-2024-35821

MEDIUM

Linux Kernel 2.6.27-6.8.2 - Use-After-Free in UBIFS Page Cache Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(), which is after we copied the new data into the page.

References (11)

Core 11
Core References

Scores

CVSS v3 5.5
EPSS 0.0057
EPSS Percentile 42.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-772
Status published
Products (30)
debian/debian_linux 10.0
linux/Kernel 2.6.27 - 4.19.312linux
linux/Kernel 4.20.0 - 5.4.274linux
linux/Kernel 5.11.0 - 5.15.154linux
linux/Kernel 5.16.0 - 6.1.84linux
linux/Kernel 5.5.0 - 5.10.215linux
linux/Kernel 6.2.0 - 6.6.24linux
linux/Kernel 6.7.0 - 6.7.12linux
linux/Kernel 6.8.0 - 6.8.3linux
Linux/Linux < 2.6.27
... and 20 more
Published May 17, 2024
Tracked Since Feb 18, 2026