VMCI: Fix use-after-free when removing resource in vmci_resource_remove()

CVE-2024-46738

What is CVE-2024-46738?

A vulnerability has been identified in the VMware VMCI within the Linux kernel, related to the resource removal process in the vmci_resource_remove function. The issue stems from an improper handling of resource types during removal, allowing for the possibility of two resources having the same handle. As a result, when a resource is removed, it may not be the one intended, leading to a scenario where the object has already been freed while still being referenced. This can lead to a use-after-free condition, which poses potential risks for data integrity and system stability. Mitigations involve patching to ensure type checks are enforced when resources are managed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References