CVE-2024-0562

Summary

A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.

Affected Software

VendorProductVersion RangeStatus
0 < 6.0-rc3affected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support0:4.18.0-372.87.1.el8_6 < *unaffected
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 80:4.18.0-372.87.1.el8_6 < *unaffected

Weaknesses

  • CWE-416: Use After Free

Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References