Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,545 results · Feed
-
High 7.8
cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after…
-
High 7.8
btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing or…
-
High 7.8
net: explicitly clear the sk pointer, when pf->create fails
In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the exact same KASAN splat as in commit 6cd4a78d962b ("net: do not leave a dangling sk pointer, when socke…
-
High 8.4
pywasm3 contains a Use-After-Free in ForEachModule
wasm3 139076a contains a Use-After-Free in ForEachModule.
-
Critical 9.8
tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached…
-
High 7.8
usb: typec: altmode should keep reference to parent
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to its parent device, but without keeping a reference to it. When registering the altmode, get a referenc…
-
High 7.8
drm/xe: Don't free job in TDR
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR can pass the run_job thread resulting in UAF. It is only safe for free job to naturally be called by the scheduler. Rather …
-
High 8.8
Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap…
-
High 8.8
Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to p…
-
High 7.8
netfilter: bpf: must hold reference on net namespace
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_l…
-
High 7.8
net: sched: fix use-after-free in taprio_change()
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in taprio_change() In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section pro…
-
High 7.8
net: sched: use RCU read-side critical section in taprio_dump()
In the Linux kernel, the following vulnerability has been resolved: net: sched: use RCU read-side critical section in taprio_dump() Fix possible use-after-free in 'taprio_dump()' by adding RCU read-side critical section there. Never seen on x86 but found on a…
-
High 8.0
Bluetooth: SCO: Fix UAF on sco_sock_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco…
-
High 8.0
Bluetooth: ISO: Fix UAF on iso_sock_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on iso_sock_timeout conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock so this checks if the conn->sk is still valid by checking if it part of iso…
-
High 7.8
nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
In the Linux kernel, the following vulnerability has been resolved: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the function `nfs4_state_destroy_net` in `nfs4_…
-
High 7.8
KVM: arm64: Unregister redistributor for failed vCPU creation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unregister redistributor for failed vCPU creation Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM: BUG: KASAN: slab-use-after-free in kv…
-
Critical 9.8
nfsd: fix race between laundromat and free_stateid
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and free_stateid There is a race between laundromat handling of revoked delegations and a client sending free_stateid operation. Laundromat thread finds that…
-
High 7.8
Use After Free in GPS
Memory corruption during GNSS HAL process initialization.
-
High 7.8
Use After Free in Graphics Linux
Memory corruption while processing GPU commands.
-
High 7.8
Use After Free in Automotive GPU
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
-
High 7.8
Use After Free in Computer Vision
Memory corruption while handling session errors from firmware.
-
High 7.5
Use After Free in WLAN Host Communication
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
-
Medium 6.7
Use After Free in ComputerVision
Memory corruption while processing IOCTL calls to unmap the buffers.
-
Medium 6.7
Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps.
-
High 8.8
Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap …
-
High 7.8
Autodesk AutoCAD ACTranslators 3DM File Parsing Use-After-Free Code Execution Vulnerability
A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of …
-
High 7.8
Autodesk AutoCAD MODEL File Parsing Use-After-Free Code Execution Vulnerability
A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context…
-
High 7.8
Autodesk AutoCAD 3DM File Parsing Use-After-Free Code Execution Vulnerability
A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of …
-
Medium 6.5
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable cra…
-
Critical 9.8
ksmbd: fix user-after-free from session log off
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add session_l…
-
Critical 9.8
mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Syzkaller reported this splat: ================================================================== BUG: KASAN: slab-use-after-free in …
-
High 7.8
net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()
In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() Commit a3c1e45156ad ("net: microchip: vcap: Fix use-after-free error in kunit test") fixed the use-after-free error, …
-
High 7.8
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by ta…
-
High 8.4CVE-2024-44285 Public exploit
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.1 and iPadOS 18.1, …
-
High 7.8
uprobe: avoid out-of-bounds memory access of fetching args
In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-sp…
-
High 7.4
In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free. This could l…
-
High 7.8
In ufshc_scsi_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. This could lead …
-
High 8.4
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function w…
-
High 8.2
Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability
A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.
-
Medium 5.9
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability