CVE-2024-11704

What it actually does

A double-free in sec_pkcs7_decoder_start_decrypt() during error handling allows the same symmetric key to be freed twice, resulting in memory corruption.

Why it matters to the business

Attackers could crash affected applications or achieve arbitrary code execution on end-user systems, increasing risk of data theft or ransomware on widely deployed desktop software.

How an attack unfolds

An attacker crafts malicious PKCS7 data that forces an error path in the decryption routine, triggering the double-free of a symmetric key to corrupt memory and potentially execute attacker-controlled code.

How to fix it

Upgrade to the fixed versions provided for each affected package; for linux (Debian:11) install kernel 5.10.216-1 or later.

How to confirm the fix worked

Confirm the installed package versions match or exceed the listed fixed releases and verify the decoder no longer exhibits double-free behavior under error conditions.

Typical attack path

1. Locate targets running vulnerable versions of the affected software
2. Prepare malicious PKCS7 content designed to hit the error path
3. Deliver the payload via email attachment or web page
4. Trigger the double-free and leverage resulting memory corruption for code execution

How to detect it

Review application crash logs and memory allocator traces for repeated free operations on the same key object within the PKCS7 decoder error path.

What your security team should do

• Apply the listed fixed package versions immediately on all affected systems
• Prioritize updates for any internet-facing or high-value endpoints
• Monitor EPSS and threat intelligence feeds for any rise in exploitation activity