CVE-2024-0217
Assigner: redhat
Published: 2024-01-03T17:04:37.841Z
State: PUBLISHED
title: Packagekitd: use-after-free in idle function callback
metrics: other: content: value: Low
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
format: CVSS
descriptions: value: A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.
affected: versions: status: affected
version: 1.2.0
lessThan: 1.2.7
versionType: semver
packageName: PackageKit
collectionURL: https://github.com/PackageKit/PackageKit
defaultStatus: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: PackageKit
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: compat-PackageKit08
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: PackageKit
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: PackageKit
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: PackageKit
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
datePublic: 2024-01-03T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-416
description: Use After Free
type: CWE
x_redhatCweChain: CWE-416: Use After Free
workarounds: value: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
timeline: time: 2024-01-03T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-01-03T00:00:00+00:00
value: Made public.
credits: value: This issue was discovered by Thibault Guittet (Red Hat).