CVE-2024-40947
Description
A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA). This vulnerability allows a local user to cause a denial of service (DoS) by crashing the system. The issue occurs because a memory allocation within a Read-Copy Update (RCU) critical section can sleep unexpectedly, violating kernel synchronization guarantees. As a result, concurrent policy rule operations can trigger a use-after-free memory error during integrity policy evaluation.
Statement
This vulnerability is classified as having a Low severity impact because triggering the condition requires local privileges to alter policies alongside precise race conditions during integrity rule processing. In standard Red Hat Enterprise Linux environments, active Integrity Measurement Architecture (IMA) rule management is not enabled by default for unprivileged workloads, substantially minimizing exposure. Furthermore, the blast radius is restricted to a local denial of service via a kernel crash, without compromising confidentiality or integrity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.1 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | Low | Low |
| Privileges Required | High | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
