GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47732 (GCVE-0-2024-47732)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-08-05 11:39
VLAI
Title
crypto: iaa - Fix potential use after free bug
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix potential use after free bug The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free. The good news is that, so far as I can tell, nothing implements the ->free() function and the use after free happens in dead code. But, with this fix, when something does implement it, we'll be ready. :)
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b190447e0fa3ef7355480d641d078962e03768b4 , < b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9 (git)
Affected: b190447e0fa3ef7355480d641d078962e03768b4 , < c66f0be993ba52410edab06124c54ecf143b05c1 (git)
Affected: b190447e0fa3ef7355480d641d078962e03768b4 , < e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:00:23.321924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:15.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/iaa/iaa_crypto_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9",
              "status": "affected",
              "version": "b190447e0fa3ef7355480d641d078962e03768b4",
              "versionType": "git"
            },
            {
              "lessThan": "c66f0be993ba52410edab06124c54ecf143b05c1",
              "status": "affected",
              "version": "b190447e0fa3ef7355480d641d078962e03768b4",
              "versionType": "git"
            },
            {
              "lessThan": "e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209",
              "status": "affected",
              "version": "b190447e0fa3ef7355480d641d078962e03768b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/iaa/iaa_crypto_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: iaa - Fix potential use after free bug\n\nThe free_device_compression_mode(iaa_device, device_mode) function frees\n\"device_mode\" but it iss passed to iaa_compression_modes[i]-\u003efree() a few\nlines later resulting in a use after free.\n\nThe good news is that, so far as I can tell, nothing implements the\n-\u003efree() function and the use after free happens in dead code.  But, with\nthis fix, when something does implement it, we\u0027ll be ready.  :)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable teardown is reached only through local operations \u2014 idxd sysfs driver bind/unbind, module unload, or a local crypto/acomp request dropping the final workqueue reference. Nothing in drivers/crypto/intel/iaa/ processes remote input, so there is no network or adjacent path.\nAC:H - The UAF statement is guarded by `iaa_compression_modes[i]-\u003efree` being non-NULL, and the only in-tree registrant (iaa_aecs_init_fixed) passes NULL, making the call site dead code on every mainline kernel; the attacker cannot cause a -\u003efree implementation to exist. Additionally CONFIG_CRYPTO_DEV_IAA_CRYPTO is default-n and in no defconfig, requires Intel IAA hardware, and the unprivileged variant needs an administrator to concurrently unbind the wq \u2014 all conditions outside attacker control.\nPR:L - Once the preconditions hold, the vulnerable teardown can execute in an unprivileged context: iaa_wq_put() on the acomp compress/decompress path (reachable by any local user via the registered \"deflate\" algorithm, e.g. through zswap) drops the final reference and calls free_iaa_device() \u2192 remove_device_compression_modes(). The dominant paths (unbind, module unload, probe) are root-only, but this unprivileged final-put path exists.\nUI:N - No victim action such as opening a file or mounting a filesystem is needed; the freed-pointer callback runs as a direct consequence of the teardown sequence itself.\nS:U - The corruption is confined to kernel slab memory within the same security authority \u2014 there is no VM, IOMMU, or sandbox boundary crossed by this driver teardown path.\nC:H - A use-after-free on a kmalloc\u0027d struct iaa_device_compression_mode lets an attacker who reclaims the slot control the fields the -\u003efree() callback dereferences (name pointer, aecs_comp_table, DMA address), which can be leveraged into a kernel memory read primitive.\nI:H - The freed object is passed to a function pointer callback that operates on attacker-reclaimable fields, giving heap-spray-based write primitives (including a controlled dma_free_coherent/kfree of an attacker-chosen address) that can be escalated toward control-flow hijacking.\nA:H - Even without successful exploitation, dereferencing and double-freeing the released allocation produces slab corruption, KASAN splats, or a kernel panic, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:48.573Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c66f0be993ba52410edab06124c54ecf143b05c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209"
        }
      ],
      "title": "crypto: iaa - Fix potential use after free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47732",
    "datePublished": "2024-10-21T12:14:03.863Z",
    "dateReserved": "2024-09-30T16:00:12.958Z",
    "dateUpdated": "2026-08-05T11:39:48.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47732",
      "date": "2026-09-16",
      "epss": "0.00228",
      "percentile": "0.13698"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"C22AF5AC-7F54-4360-A603-8A032CC9087A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: iaa - Fix potential use after free bug\\n\\nThe free_device_compression_mode(iaa_device, device_mode) function frees\\n\\\"device_mode\\\" but it iss passed to iaa_compression_modes[i]-\u003efree() a few\\nlines later resulting in a use after free.\\n\\nThe good news is that, so far as I can tell, nothing implements the\\n-\u003efree() function and the use after free happens in dead code.  But, with\\nthis fix, when something does implement it, we\u0027ll be ready.  :)\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: crypto: iaa - Fix potential use after free bug La funci\\u00f3n free_device_compression_mode(iaa_device, device_mode) libera \\\"device_mode\\\" pero se pasa a iaa_compression_modes[i]-\u0026gt;free() unas l\\u00edneas m\\u00e1s adelante, lo que da como resultado un use after free. La buena noticia es que, hasta donde puedo decir, nada implementa la funci\\u00f3n -\u0026gt;free() y el use after free ocurre en c\\u00f3digo muerto. Pero, con esta soluci\\u00f3n, cuando algo la implemente, estaremos listos. :)\"}]",
      "id": "CVE-2024-47732",
      "lastModified": "2024-12-20T15:44:01.303",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T13:15:03.363",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c66f0be993ba52410edab06124c54ecf143b05c1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47732\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:03.363\",\"lastModified\":\"2026-08-04T11:20:45.960\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: iaa - Fix potential use after free bug\\n\\nThe free_device_compression_mode(iaa_device, device_mode) function frees\\n\\\"device_mode\\\" but it iss passed to iaa_compression_modes[i]-\u003efree() a few\\nlines later resulting in a use after free.\\n\\nThe good news is that, so far as I can tell, nothing implements the\\n-\u003efree() function and the use after free happens in dead code.  But, with\\nthis fix, when something does implement it, we\u0027ll be ready.  :)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: crypto: iaa - Fix potential use after free bug La funci\u00f3n free_device_compression_mode(iaa_device, device_mode) libera \\\"device_mode\\\" pero se pasa a iaa_compression_modes[i]-\u0026gt;free() unas l\u00edneas m\u00e1s adelante, lo que da como resultado un use after free. La buena noticia es que, hasta donde puedo decir, nada implementa la funci\u00f3n -\u0026gt;free() y el use after free ocurre en c\u00f3digo muerto. Pero, con esta soluci\u00f3n, cuando algo la implemente, estaremos listos. :)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/crypto/intel/iaa/iaa_crypto_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b190447e0fa3ef7355480d641d078962e03768b4\",\"lessThan\":\"b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b190447e0fa3ef7355480d641d078962e03768b4\",\"lessThan\":\"c66f0be993ba52410edab06124c54ecf143b05c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b190447e0fa3ef7355480d641d078962e03768b4\",\"lessThan\":\"e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/crypto/intel/iaa/iaa_crypto_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:00:23.321924Z\",\"id\":\"CVE-2024-47732\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"C22AF5AC-7F54-4360-A603-8A032CC9087A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c66f0be993ba52410edab06124c54ecf143b05c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:48:42+00:00",
      "cve": "CVE-2024-47732",
      "id": "CVE-2024-47732",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: iaa - Fix potential use after free bug",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47732.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:52:32Z",
      "cve": "CVE-2024-47732",
      "id": "CVE-2024-47732",
      "initial_release_date": "2024-10-21T15:46:41Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "443",
      "product_status:recommended": "367",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47732",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47732.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47732\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:00:23.321924Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:00:26.464Z\"}}], \"cna\": {\"title\": \"crypto: iaa - Fix potential use after free bug\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b190447e0fa3ef7355480d641d078962e03768b4\", \"lessThan\": \"b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b190447e0fa3ef7355480d641d078962e03768b4\", \"lessThan\": \"c66f0be993ba52410edab06124c54ecf143b05c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b190447e0fa3ef7355480d641d078962e03768b4\", \"lessThan\": \"e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/crypto/intel/iaa/iaa_crypto_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/crypto/intel/iaa/iaa_crypto_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9\"}, {\"url\": \"https://git.kernel.org/stable/c/c66f0be993ba52410edab06124c54ecf143b05c1\"}, {\"url\": \"https://git.kernel.org/stable/c/e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: iaa - Fix potential use after free bug\\n\\nThe free_device_compression_mode(iaa_device, device_mode) function frees\\n\\\"device_mode\\\" but it iss passed to iaa_compression_modes[i]-\u003efree() a few\\nlines later resulting in a use after free.\\n\\nThe good news is that, so far as I can tell, nothing implements the\\n-\u003efree() function and the use after free happens in dead code.  But, with\\nthis fix, when something does implement it, we\u0027ll be ready.  :)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:38:29.225Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47732\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:38:29.225Z\", \"dateReserved\": \"2024-09-30T16:00:12.958Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:03.863Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.