CVE-2024-0562

What it actually does

Use-after-free in the Linux kernel's write-back infrastructure: bdi_unregister completes and frees the bdi_writeback structure, yet wb_inode_writeback_end can still schedule bandwidth estimation work that later dereferences the freed object.

Why it matters to the business

Local attackers can crash the system or execute arbitrary code with kernel privileges, leading to full host compromise, data theft, or denial of service on any Linux system running an unpatched kernel.

How an attack unfolds

An attacker with local access removes a block device or triggers write-back unregistration, races the delayed work item to dereference the freed bdi_writeback, and leverages the resulting invalid memory access for privilege escalation or kernel code execution.

How to fix it

Upgrade the linux package to version 6.9.7-1 or later on Debian 13 systems; apply the equivalent upstream kernel fix on all other distributions; reboot after installation.

How to confirm the fix worked

Confirm the running kernel version is at least 6.9.7-1; verify the bdi_writeback fix is present in the kernel source or binary; re-test device removal under load to ensure no use-after-free occurs.

Typical attack path

1. Obtain local user access on the target Linux host
2. Trigger device removal or write-back shutdown to invoke bdi_unregister
3. Race the scheduled bandwidth work item against the freed structure
4. Achieve arbitrary kernel read/write or control-flow hijack
5. Escalate to root and install persistence or exfiltrate data

How to detect it

Review kernel logs for oops, panic, or warning messages referencing bdi_writeback, wb_inode_writeback_end, or use-after-free during device removal; inspect auditd or system call logs for unusual block-device removal or write-back activity preceding crashes.

What your security team should do

• Immediately schedule kernel upgrades to 6.9.7-1 across all Debian 13 fleets
• Prioritize systems that allow untrusted local users or run containers
• Monitor vendor advisories for backported fixes on older kernels
• Restrict local device access where feasible until patches are deployed