CVE-2024-46738: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-46738 is a use-after-free vulnerability discovered in the Linux kernel's VMCI (Virtual Machine Communication Interface) driver. The vulnerability was disclosed on September 18, 2024, affecting Linux kernel versions from 3.9 through 6.10.10. The issue occurs in the vmci_resource_remove() function when removing resources from the vmci_resource_table (NVD).

The vulnerability stems from improper resource handling in the vmci_resource_remove() function. When removing a resource from vmci_resource_table, the function only compares context and resource fields of the handle, without checking the resource type. This allows creation of two resources with different types but the same handle (same context and resource fields). When attempting to remove one resource, vmci_resource_remove() may remove the wrong one, leading to a use-after-free condition when the object is freed in vmci_datagram_destroy_handle() while vmci_resource_table still holds a pointer to the freed resource (Kernel Patch).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires local access but can lead to high impacts on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires local access to exploit. It was discovered through KASAN (Kernel Address Sanitizer) detection of a use-after-free condition in the vmci_handle_is_equal function. The issue can be triggered through normal system operations involving VMCI resource management (Kernel Patch).

The vulnerability has been patched by adding a type check when removing resources from vmci_resource_table in vmci_resource_remove(). The fix ensures that both the handle and resource type match before removal. Users should update their Linux kernel to a patched version. The fix has been backported to multiple stable kernel versions (Kernel Patch).