GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56549 (GCVE-0-2024-56549)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:11 – Updated: 2026-08-05 11:44
VLAI
Title
cachefiles: Fix NULL pointer dereference in object->file
Summary
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object->file At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anon_fd uses object->file. Following is the process that triggers the issue: [write fd] [umount] cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object->file) object->file = NULL // file NULL pointer dereference! __cachefiles_write(..., file, ...) Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c8383054506c77b814489c09877b5db83fd4abf2 , < d6bba3ece960129a553d4b16f1b00c884dc0993a (git)
Affected: c8383054506c77b814489c09877b5db83fd4abf2 , < 785408bbafcfa24c9fc5b251f03fd0780ce182bd (git)
Affected: c8383054506c77b814489c09877b5db83fd4abf2 , < f98770440c9bc468e2fd878212ec9526dbe08293 (git)
Affected: c8383054506c77b814489c09877b5db83fd4abf2 , < 9582c7664103c9043e80a78f5c382aa6bdd67418 (git)
Affected: c8383054506c77b814489c09877b5db83fd4abf2 , < 31ad74b20227ce6b40910ff78b1c604e42975cf1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.129 , ≤ 6.1.* (semver)
Unaffected: 6.6.78 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:32:24.323Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/interface.c",
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6bba3ece960129a553d4b16f1b00c884dc0993a",
              "status": "affected",
              "version": "c8383054506c77b814489c09877b5db83fd4abf2",
              "versionType": "git"
            },
            {
              "lessThan": "785408bbafcfa24c9fc5b251f03fd0780ce182bd",
              "status": "affected",
              "version": "c8383054506c77b814489c09877b5db83fd4abf2",
              "versionType": "git"
            },
            {
              "lessThan": "f98770440c9bc468e2fd878212ec9526dbe08293",
              "status": "affected",
              "version": "c8383054506c77b814489c09877b5db83fd4abf2",
              "versionType": "git"
            },
            {
              "lessThan": "9582c7664103c9043e80a78f5c382aa6bdd67418",
              "status": "affected",
              "version": "c8383054506c77b814489c09877b5db83fd4abf2",
              "versionType": "git"
            },
            {
              "lessThan": "31ad74b20227ce6b40910ff78b1c604e42975cf1",
              "status": "affected",
              "version": "c8383054506c77b814489c09877b5db83fd4abf2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/interface.c",
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix NULL pointer dereference in object-\u003efile\n\nAt present, the object-\u003efile has the NULL pointer dereference problem in\nondemand-mode. The root cause is that the allocated fd and object-\u003efile\nlifetime are inconsistent, and the user-space invocation to anon_fd uses\nobject-\u003efile. Following is the process that triggers the issue:\n\n\t  [write fd]\t\t\t\t[umount]\ncachefiles_ondemand_fd_write_iter\n\t\t\t\t       fscache_cookie_state_machine\n\t\t\t\t\t cachefiles_withdraw_cookie\n  if (!file) return -ENOBUFS\n\t\t\t\t\t   cachefiles_clean_up_object\n\t\t\t\t\t     cachefiles_unmark_inode_in_use\n\t\t\t\t\t     fput(object-\u003efile)\n\t\t\t\t\t     object-\u003efile = NULL\n  // file NULL pointer dereference!\n  __cachefiles_write(..., file, ...)\n\nFix this issue by add an additional reference count to the object-\u003efile\nbefore write/llseek, and decrement after it finished."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local file-descriptor operations (write()/lseek() on a cachefiles on-demand anon fd) raced against local cookie withdrawal (umount, LRU discard, invalidation). There is no remote or adjacent-network path into fs/cachefiles/ondemand.c.\nAC:L - The attacker controls both sides of the race \u2014 they generate the demand-read traffic that makes the daemon write on the anon fd, and they trigger the withdrawal (umount of their erofs-on-fscache mount, or letting the cookie idle past the ~2s LRU timeout) \u2014 and can retry the sequence indefinitely until the window is hit.\nPR:L - Although /dev/cachefiles itself requires CAP_SYS_ADMIN, an unprivileged local user of an on-demand erofs/fscache mount (e.g. inside a container using an on-demand image) drives both the daemon\u0027s writes and the cookie withdrawal without ever needing the anon fd, so basic unprivileged local access suffices.\nUI:N - No victim action is needed; the cachefiles daemon services demand-read requests automatically as part of normal operation, and the withdrawal path is driven by the attacker\u0027s own filesystem activity.\nS:U - The corruption is confined to kernel memory within the same security authority; this is standard kernel memory corruption, not a hypervisor, IOMMU, or sandbox boundary crossing.\nC:H - The use-after-free on struct file lets llseek/SEEK_DATA/SEEK_HOLE and DIO operations act on a freed slot that filp_cachep (SLAB_TYPESAFE_BY_RCU) hands out as an unrelated struct file, exposing freed-memory contents and redirecting reads to files the attacker has no access to.\nI:H - __cachefiles_write() calls get_file() and vfs_iocb_iter_write() on the dangling pointer, inflating a reallocated file\u0027s refcount (setting up a further UAF) and writing attacker-influenced cache data \u2014 plus fallocate() \u2014 into an unrelated open file, giving a controlled write primitive.\nA:H - Dereferencing the freed/NULLed object-\u003efile causes a kernel oops or panic, and the refcount corruption on the reallocated struct file leads to further fatal memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:58.475Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6bba3ece960129a553d4b16f1b00c884dc0993a"
        },
        {
          "url": "https://git.kernel.org/stable/c/785408bbafcfa24c9fc5b251f03fd0780ce182bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f98770440c9bc468e2fd878212ec9526dbe08293"
        },
        {
          "url": "https://git.kernel.org/stable/c/9582c7664103c9043e80a78f5c382aa6bdd67418"
        },
        {
          "url": "https://git.kernel.org/stable/c/31ad74b20227ce6b40910ff78b1c604e42975cf1"
        }
      ],
      "title": "cachefiles: Fix NULL pointer dereference in object-\u003efile",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56549",
    "datePublished": "2024-12-27T14:11:30.336Z",
    "dateReserved": "2024-12-27T14:03:05.989Z",
    "dateUpdated": "2026-08-05T11:44:58.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56549",
      "date": "2026-09-16",
      "epss": "0.00229",
      "percentile": "0.1382"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19\", \"versionEndExcluding\": \"6.11.11\", \"matchCriteriaId\": \"A482F6D5-4DB0-4611-AF23-1D568CE9F2BF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.12\", \"versionEndExcluding\": \"6.12.2\", \"matchCriteriaId\": \"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: Fix NULL pointer dereference in object-\u003efile\\n\\nAt present, the object-\u003efile has the NULL pointer dereference problem in\\nondemand-mode. The root cause is that the allocated fd and object-\u003efile\\nlifetime are inconsistent, and the user-space invocation to anon_fd uses\\nobject-\u003efile. Following is the process that triggers the issue:\\n\\n\\t  [write fd]\\t\\t\\t\\t[umount]\\ncachefiles_ondemand_fd_write_iter\\n\\t\\t\\t\\t       fscache_cookie_state_machine\\n\\t\\t\\t\\t\\t cachefiles_withdraw_cookie\\n  if (!file) return -ENOBUFS\\n\\t\\t\\t\\t\\t   cachefiles_clean_up_object\\n\\t\\t\\t\\t\\t     cachefiles_unmark_inode_in_use\\n\\t\\t\\t\\t\\t     fput(object-\u003efile)\\n\\t\\t\\t\\t\\t     object-\u003efile = NULL\\n  // file NULL pointer dereference!\\n  __cachefiles_write(..., file, ...)\\n\\nFix this issue by add an additional reference count to the object-\u003efile\\nbefore write/llseek, and decrement after it finished.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cachefiles: Arreglar la desreferencia de puntero NULL en object-\u0026gt;file En la actualidad, object-\u0026gt;file tiene el problema de desreferencia de puntero NULL en el modo ondemand. La causa ra\\u00edz es que el fd asignado y el tiempo de vida de object-\u0026gt;file son inconsistentes, y la invocaci\\u00f3n del espacio de usuario a anon_fd usa object-\u0026gt;file. A continuaci\\u00f3n, se muestra el proceso que desencadena el problema: [write fd] [umount] cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object-\u0026gt;file) object-\u0026gt;file = NULL // file \\u00a1Desreferencia de puntero NULL! __cachefiles_write(..., file, ...) Solucione este problema agregando un recuento de referencia adicional al objeto-\u0026gt;archivo antes de escribir/llseek, y disminuya despu\\u00e9s de que finalice.\"}]",
      "id": "CVE-2024-56549",
      "lastModified": "2025-01-08T16:43:25.180",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-12-27T14:15:34.747",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/31ad74b20227ce6b40910ff78b1c604e42975cf1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9582c7664103c9043e80a78f5c382aa6bdd67418\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f98770440c9bc468e2fd878212ec9526dbe08293\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56549\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:34.747\",\"lastModified\":\"2026-08-04T11:22:09.730\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: Fix NULL pointer dereference in object-\u003efile\\n\\nAt present, the object-\u003efile has the NULL pointer dereference problem in\\nondemand-mode. The root cause is that the allocated fd and object-\u003efile\\nlifetime are inconsistent, and the user-space invocation to anon_fd uses\\nobject-\u003efile. Following is the process that triggers the issue:\\n\\n\\t  [write fd]\\t\\t\\t\\t[umount]\\ncachefiles_ondemand_fd_write_iter\\n\\t\\t\\t\\t       fscache_cookie_state_machine\\n\\t\\t\\t\\t\\t cachefiles_withdraw_cookie\\n  if (!file) return -ENOBUFS\\n\\t\\t\\t\\t\\t   cachefiles_clean_up_object\\n\\t\\t\\t\\t\\t     cachefiles_unmark_inode_in_use\\n\\t\\t\\t\\t\\t     fput(object-\u003efile)\\n\\t\\t\\t\\t\\t     object-\u003efile = NULL\\n  // file NULL pointer dereference!\\n  __cachefiles_write(..., file, ...)\\n\\nFix this issue by add an additional reference count to the object-\u003efile\\nbefore write/llseek, and decrement after it finished.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cachefiles: Arreglar la desreferencia de puntero NULL en object-\u0026gt;file En la actualidad, object-\u0026gt;file tiene el problema de desreferencia de puntero NULL en el modo ondemand. La causa ra\u00edz es que el fd asignado y el tiempo de vida de object-\u0026gt;file son inconsistentes, y la invocaci\u00f3n del espacio de usuario a anon_fd usa object-\u0026gt;file. A continuaci\u00f3n, se muestra el proceso que desencadena el problema: [write fd] [umount] cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object-\u0026gt;file) object-\u0026gt;file = NULL // file \u00a1Desreferencia de puntero NULL! __cachefiles_write(..., file, ...) Solucione este problema agregando un recuento de referencia adicional al objeto-\u0026gt;archivo antes de escribir/llseek, y disminuya despu\u00e9s de que finalice.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cachefiles/interface.c\",\"fs/cachefiles/ondemand.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c8383054506c77b814489c09877b5db83fd4abf2\",\"lessThan\":\"d6bba3ece960129a553d4b16f1b00c884dc0993a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8383054506c77b814489c09877b5db83fd4abf2\",\"lessThan\":\"785408bbafcfa24c9fc5b251f03fd0780ce182bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8383054506c77b814489c09877b5db83fd4abf2\",\"lessThan\":\"f98770440c9bc468e2fd878212ec9526dbe08293\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8383054506c77b814489c09877b5db83fd4abf2\",\"lessThan\":\"9582c7664103c9043e80a78f5c382aa6bdd67418\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8383054506c77b814489c09877b5db83fd4abf2\",\"lessThan\":\"31ad74b20227ce6b40910ff78b1c604e42975cf1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cachefiles/interface.c\",\"fs/cachefiles/ondemand.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.129\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.78\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"A482F6D5-4DB0-4611-AF23-1D568CE9F2BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/31ad74b20227ce6b40910ff78b1c604e42975cf1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/785408bbafcfa24c9fc5b251f03fd0780ce182bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9582c7664103c9043e80a78f5c382aa6bdd67418\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6bba3ece960129a553d4b16f1b00c884dc0993a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f98770440c9bc468e2fd878212ec9526dbe08293\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:36+00:00",
      "cve": "CVE-2024-56549",
      "id": "CVE-2024-56549",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cachefiles: Fix NULL pointer dereference in object-\u003efile",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56549.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:21:30Z",
      "cve": "CVE-2024-56549",
      "id": "CVE-2024-56549",
      "initial_release_date": "2024-12-28T03:49:04Z",
      "product_status:known_affected": "418",
      "product_status:known_not_affected": "389",
      "product_status:recommended": "468",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56549",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56549.json",
      "version": "75"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.