CWE-416: Use After Free, page 98
Filter
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
What the weakness is: CWE-416 at MITRE
Ask an AI about CWE-416
Show the prompt
Explain CWE-416: Use After Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/416.html and https://cve.bz/cve/cwe/416?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2024-40909EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free in bpf_link_free() After commit 1a80dbcb2dba, bpf_link can be freed by link->ops->dealloc_deferred, but the code still tests and uses…
- 5.5CVE-2024-40907EPSS 0.6%
In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDP_TX action In the XDP_TX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ion…
- 7.8CVE-2024-40906EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop health timer during driver removal Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwar…
- 7.8CVE-2024-40903EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen w…
- 7.8CVE-2024-40900EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the reque…
- 7.8CVE-2024-40899EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() We got the following issue in a fuzz test of randomly issuing the restore command: =================…
- 7.8CVE-2024-39510EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the following issue in a fuzz test of randomly issuing the restore command: ============…
- 7.0CVE-2024-39503EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipse…
- 7.8CVE-2024-39502EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the cu…
- 7.8CVE-2024-39496EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info during creation of a block group, we can race with a device replace operation a…
- 7.8CVE-2024-39495EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_swit…
- 7.8CVE-2024-39494EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (…
- 6.0CVE-2024-39528EPSS 0.3%
A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved plat…
- 7.8CVE-2024-31339EPSS 0.1%
In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e…
- 7.8CVE-2024-23697EPSS 0.1%
In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is…
- 7.8CVE-2024-23696EPSS 0.1%
In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is n…
- 7.8CVE-2024-38085EPSS 5.3%
Windows Graphics Component Elevation of Privilege Vulnerability
- 7.5CVE-2024-38078EPSS 0.7%
Xbox Wireless Adapter Remote Code Execution Vulnerability
- 7.8CVE-2024-38066EPSS 0.9%
Windows Win32k Elevation of Privilege Vulnerability
- 7.8CVE-2024-38059EPSS 3.7%
Win32k Elevation of Privilege Vulnerability
- 8.8CVE-2024-38053EPSS 1.1%
Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
- 8.8CVE-2024-37320EPSS 1.6%
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- 8.1CVE-2024-35264EPSS 2.6%
.NET and Visual Studio Remote Code Execution Vulnerability
- 8.8CVE-2024-21332EPSS 1.8%
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- 8.8CVE-2024-21308EPSS 1.6%
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- 8.8CVE-2024-21303EPSS 1.5%
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- 7.0CVE-2024-39486EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard <mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de> filp->pid is sup…
- 9.8CVE-2024-37030EPSS 0.6%
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free.
- 9.1CVE-2024-39305EPSS 0.6%
Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerabil…
- 7.8CVE-2024-23380EPSS 0.2%
Memory corruption while handling user packets during VBO bind operation.
- 7.8CVE-2024-23373EPSS 0.1%
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
- 5.3CVE-2024-38375EPSS 0.3%
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the resu…
- 7.8CVE-2024-39463EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread…
- 5.5CVE-2024-38385EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() irq_find_at_or_after() dereferences the interrupt descriptor which is returned by mt_find() while neithe…
- 7.8CVE-2024-37007EPSS 0.4%
A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current …
- 7.8CVE-2024-37004EPSS 0.4%
A maliciously crafted SLDPRT file, when parsed in ASMKERN229A.dll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current pr…
- 7.8CVE-2024-23158EPSS 0.4%
A maliciously crafted IGES file, when parsed in ASMImport229A.dll through Autodesk applications, can be used to cause a use-after-free vulnerability. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary c…
- 7.8CVE-2024-23142EPSS 0.4%
A maliciously crafted CATPART, STP, and MODEL file, when parsed in atf_dwg_consumer.dll, rose_x64_vc15.dll and libodxdll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerab…
- 8.8CVE-2024-6293EPSS 0.6%
Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8CVE-2024-6292EPSS 0.6%
Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8CVE-2024-6291EPSS 0.7%
Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8CVE-2024-6290EPSS 0.6%
Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 7.8CVE-2024-38630EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If …
- 7.8CVE-2024-38629EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guarante…
- 7.8CVE-2022-48771EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unuse…
- 7.0CVE-2022-48759EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg…
- 7.8CVE-2022-48754EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: phylib: fix potential use-after-free Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phy_device_reset(phydev) after the put_device() call in …
- 7.8CVE-2022-48742EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potential…
- 7.8CVE-2022-48735EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and a…
- 7.8CVE-2022-48733EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction…