CVE-2024-0217
Publication date 3 January 2024
Last updated 24 July 2024
Ubuntu priority
A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.
Read the notes from the security team
Why is this CVE low priority?
Likely only a denial of service issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| packagekit | 24.04 LTS noble |
Needs evaluation
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Ignored |
Notes
mdeslaur
There is no complete fix for this issue, but this commit in 1.2.7 apparently reduces the impact: https://github.com/PackageKit/PackageKit/commit/64278c9127e3333342b56ead99556161f7e86f79
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.3 · Low
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |