GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47675 (GCVE-0-2024-47675)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-08-05 11:39
VLAI
Title
bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the error_free label and frees the array of bpf_uprobe's without calling bpf_uprobe_unregister(). This leaks bpf_uprobe->uprobe and worse, this frees bpf_uprobe->consumer without removing it from the uprobe->consumers list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:08 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 89ae89f53d201143560f1e9ed4bfa62eee34f88e , < 790c630ab0e7d7aba6d186581d4627c09fce60f3 (git)
Affected: 89ae89f53d201143560f1e9ed4bfa62eee34f88e , < 7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee (git)
Affected: 89ae89f53d201143560f1e9ed4bfa62eee34f88e , < cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c (git)
Affected: 89ae89f53d201143560f1e9ed4bfa62eee34f88e , < 5fe6e308abaea082c20fbf2aa5df8e14495622cf (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:08:07.484678Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:17.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "790c630ab0e7d7aba6d186581d4627c09fce60f3",
              "status": "affected",
              "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
              "versionType": "git"
            },
            {
              "lessThan": "7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee",
              "status": "affected",
              "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
              "versionType": "git"
            },
            {
              "lessThan": "cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c",
              "status": "affected",
              "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
              "versionType": "git"
            },
            {
              "lessThan": "5fe6e308abaea082c20fbf2aa5df8e14495622cf",
              "status": "affected",
              "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in bpf_uprobe_multi_link_attach()\n\nIf bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the\nerror_free label and frees the array of bpf_uprobe\u0027s without calling\nbpf_uprobe_unregister().\n\nThis leaks bpf_uprobe-\u003euprobe and worse, this frees bpf_uprobe-\u003econsumer\nwithout removing it from the uprobe-\u003econsumers list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local `bpf(BPF_LINK_CREATE)` syscall with a `BPF_TRACE_UPROBE_MULTI` attach type, and the freed memory is subsequently dereferenced by executing a local file. There is no remote or adjacent-network path into `bpf_uprobe_multi_link_attach()`.\nAC:L - The failing condition is `bpf_link_prime()` returning `-EMFILE` from `get_unused_fd_flags()`, which the attacker forces deterministically by exhausting or lowering `RLIMIT_NOFILE` before the call \u2014 no race and no uncontrolled state. The attacker also chooses the freed allocation size via `cnt` and triggers the dangling consumer at will by exec\u0027ing their own uprobe\u0027d binary.\nPR:L - Loading the `BPF_PROG_TYPE_KPROBE` program requires `CAP_BPF`+`CAP_PERFMON`, which is a restricted tracing capability set rather than full administrative control, and it is routinely delegated to unprivileged contexts via BPF tokens (bpffs `delegate_cmds`/`delegate_progs`) or granted to non-root observability/container workloads. Such a caller has no other authority over the kernel, so this is low privilege, not high.\nUI:N - The attacker performs every step themselves \u2014 attach the multi-uprobe link, force the `bpf_link_prime()` failure, spray the freed slab, then execute their own traced binary to hit the breakpoint. No victim action is required.\nS:U - The use-after-free corrupts kernel heap memory and hijacks kernel control flow within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct bpf_uprobe` array is reclaimed by attacker-sprayed data and then used as a `struct uprobe_consumer` with attacker-controlled `handler`/`next`/`link` pointers, yielding arbitrary kernel-memory read via the resulting indirect calls and `bpf_prog_run()` dereferences. That is full disclosure of kernel memory.\nI:H - The dangling `uc-\u003ehandler(uc, regs)` call in `handler_chain()` and the `prog-\u003ebpf_func()` dispatch reached through the freed `uprobe-\u003elink` give control-flow hijack from an attacker-sized, attacker-timed heap object, which is a standard route to arbitrary kernel write and privilege escalation.\nA:H - Even without exploitation, walking the freed consumer list on the next breakpoint hit dereferences poisoned or reused slab memory, producing a KASAN slab-use-after-free and a kernel oops/panic \u2014 exactly what syzbot reported. It can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:21.879Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/790c630ab0e7d7aba6d186581d4627c09fce60f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fe6e308abaea082c20fbf2aa5df8e14495622cf"
        }
      ],
      "title": "bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47675",
    "datePublished": "2024-10-21T11:53:19.762Z",
    "dateReserved": "2024-09-30T16:00:12.937Z",
    "dateUpdated": "2026-08-05T11:39:21.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47675",
      "date": "2026-09-19",
      "epss": "0.00239",
      "percentile": "0.15318"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E729C51E-0317-4ABD-B95D-E6F8D80A17F6",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in bpf_uprobe_multi_link_attach()\n\nIf bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the\nerror_free label and frees the array of bpf_uprobe\u0027s without calling\nbpf_uprobe_unregister().\n\nThis leaks bpf_uprobe-\u003euprobe and worse, this frees bpf_uprobe-\u003econsumer\nwithout removing it from the uprobe-\u003econsumers list."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Se corrige el use after free en bpf_uprobe_multi_link_attach() Si bpf_link_prime() fallo, bpf_uprobe_multi_link_attach() va a la etiqueta error_free y libera la matriz de bpf_uprobe sin llamar a bpf_uprobe_unregister(). Esto filtra bpf_uprobe-\u0026gt;uprobe y, lo que es peor, libera bpf_uprobe-\u0026gt;consumer sin eliminarlo de la lista uprobe-\u0026gt;consumers."
        }
      ],
      "id": "CVE-2024-47675",
      "lastModified": "2024-10-23T13:39:38.647",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T12:15:04.600",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5fe6e308abaea082c20fbf2aa5df8e14495622cf"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/790c630ab0e7d7aba6d186581d4627c09fce60f3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2024-11-09T00:00:00.000Z",
      "cve": "CVE-2024-47675",
      "id": "msrc_CVE-2024-47675",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47675.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/bpf_trace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "790c630ab0e7d7aba6d186581d4627c09fce60f3",
                    "status": "affected",
                    "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee",
                    "status": "affected",
                    "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c",
                    "status": "affected",
                    "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5fe6e308abaea082c20fbf2aa5df8e14495622cf",
                    "status": "affected",
                    "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/bpf_trace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E729C51E-0317-4ABD-B95D-E6F8D80A17F6",
                    "versionEndExcluding": "6.6.54",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
                    "versionEndExcluding": "6.10.13",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                    "versionEndExcluding": "6.11.2",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in bpf_uprobe_multi_link_attach()\n\nIf bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the\nerror_free label and frees the array of bpf_uprobe\u0027s without calling\nbpf_uprobe_unregister().\n\nThis leaks bpf_uprobe-\u003euprobe and worse, this frees bpf_uprobe-\u003econsumer\nwithout removing it from the uprobe-\u003econsumers list."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Se corrige el use after free en bpf_uprobe_multi_link_attach() Si bpf_link_prime() fallo, bpf_uprobe_multi_link_attach() va a la etiqueta error_free y libera la matriz de bpf_uprobe sin llamar a bpf_uprobe_unregister(). Esto filtra bpf_uprobe-\u0026gt;uprobe y, lo que es peor, libera bpf_uprobe-\u0026gt;consumer sin eliminarlo de la lista uprobe-\u0026gt;consumers."
          }
        ],
        "id": "CVE-2024-47675",
        "lastModified": "2026-08-04T11:20:38.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47675",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:08:07.484678Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T12:15:04.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5fe6e308abaea082c20fbf2aa5df8e14495622cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/790c630ab0e7d7aba6d186581d4627c09fce60f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:02:47+00:00",
      "cve": "CVE-2024-47675",
      "id": "CVE-2024-47675",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "558",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "63",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47675.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:58:11Z",
      "cve": "CVE-2024-47675",
      "id": "CVE-2024-47675",
      "initial_release_date": "2024-10-21T15:47:58Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "426",
      "product_status:recommended": "367",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47675",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47675.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47675",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-21T13:08:07.484678Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-21T13:08:10.789Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/trace/bpf_trace.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "790c630ab0e7d7aba6d186581d4627c09fce60f3",
                  "status": "affected",
                  "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                  "versionType": "git"
                },
                {
                  "lessThan": "7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee",
                  "status": "affected",
                  "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                  "versionType": "git"
                },
                {
                  "lessThan": "cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c",
                  "status": "affected",
                  "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                  "versionType": "git"
                },
                {
                  "lessThan": "5fe6e308abaea082c20fbf2aa5df8e14495622cf",
                  "status": "affected",
                  "version": "89ae89f53d201143560f1e9ed4bfa62eee34f88e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "kernel/trace/bpf_trace.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.54",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.54",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.13",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.2",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in bpf_uprobe_multi_link_attach()\n\nIf bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the\nerror_free label and frees the array of bpf_uprobe\u0027s without calling\nbpf_uprobe_unregister().\n\nThis leaks bpf_uprobe-\u003euprobe and worse, this frees bpf_uprobe-\u003econsumer\nwithout removing it from the uprobe-\u003econsumers list."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerability is reached only through the local `bpf(BPF_LINK_CREATE)` syscall with a `BPF_TRACE_UPROBE_MULTI` attach type, and the freed memory is subsequently dereferenced by executing a local file. There is no remote or adjacent-network path into `bpf_uprobe_multi_link_attach()`.\nAC:L - The failing condition is `bpf_link_prime()` returning `-EMFILE` from `get_unused_fd_flags()`, which the attacker forces deterministically by exhausting or lowering `RLIMIT_NOFILE` before the call \u2014 no race and no uncontrolled state. The attacker also chooses the freed allocation size via `cnt` and triggers the dangling consumer at will by exec\u0027ing their own uprobe\u0027d binary.\nPR:L - Loading the `BPF_PROG_TYPE_KPROBE` program requires `CAP_BPF`+`CAP_PERFMON`, which is a restricted tracing capability set rather than full administrative control, and it is routinely delegated to unprivileged contexts via BPF tokens (bpffs `delegate_cmds`/`delegate_progs`) or granted to non-root observability/container workloads. Such a caller has no other authority over the kernel, so this is low privilege, not high.\nUI:N - The attacker performs every step themselves \u2014 attach the multi-uprobe link, force the `bpf_link_prime()` failure, spray the freed slab, then execute their own traced binary to hit the breakpoint. No victim action is required.\nS:U - The use-after-free corrupts kernel heap memory and hijacks kernel control flow within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct bpf_uprobe` array is reclaimed by attacker-sprayed data and then used as a `struct uprobe_consumer` with attacker-controlled `handler`/`next`/`link` pointers, yielding arbitrary kernel-memory read via the resulting indirect calls and `bpf_prog_run()` dereferences. That is full disclosure of kernel memory.\nI:H - The dangling `uc-\u003ehandler(uc, regs)` call in `handler_chain()` and the `prog-\u003ebpf_func()` dispatch reached through the freed `uprobe-\u003elink` give control-flow hijack from an attacker-sized, attacker-timed heap object, which is a standard route to arbitrary kernel write and privilege escalation.\nA:H - Even without exploitation, walking the freed consumer list on the next breakpoint hit dereferences poisoned or reused slab memory, producing a KASAN slab-use-after-free and a kernel oops/panic \u2014 exactly what syzbot reported. It can be re-triggered at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:39:21.879Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/790c630ab0e7d7aba6d186581d4627c09fce60f3"
            },
            {
              "url": "https://git.kernel.org/stable/c/7c1d782e5afbf7c50ba74ecc4ddc18a05d63e5ee"
            },
            {
              "url": "https://git.kernel.org/stable/c/cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c"
            },
            {
              "url": "https://git.kernel.org/stable/c/5fe6e308abaea082c20fbf2aa5df8e14495622cf"
            }
          ],
          "title": "bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-47675",
        "datePublished": "2024-10-21T11:53:19.762Z",
        "dateReserved": "2024-09-30T16:00:12.937Z",
        "dateUpdated": "2026-08-05T11:39:21.879Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.