Security readout for executives and security teams
Plain-English summary
A local Linux user may trigger a file-locking race that leaves stale lock state referencing freed memory. Reading /proc/locks afterward can expose kernel memory. This could disclose sensitive information, but the supplied technical description says the flaw cannot corrupt kernel memory.
Executive priority
Treat as an expedited patching issue on shared, multi-user, or multi-tenant Linux systems. Other systems can follow risk-based kernel maintenance after confirming vendor status. There is no supplied evidence of active exploitation, but potential kernel-memory disclosure warrants timely remediation.
Technical view
A race between fcntl_setlk() and close() may create a POSIX lock that later cannot be removed because an LSM denies removal or memory allocation fails. Subsequent lock_get_status() access through /proc/locks causes use-after-free reads. The fix uses locks_remove_posix() to remove locks reliably.
Likely exposure
Exposure is limited to Linux systems running affected or unpatched vendor kernels where a user has local, low-privileged access. Multi-user and multi-tenant hosts deserve particular attention. Distribution backports mean version strings alone may not establish vulnerability.
Exploitation context
The supplied CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. The source suggests arbitrary kernel-memory disclosure is likely, but provides no evidence of memory corruption. This CVE is not listed as KEV in the supplied bundle, and no active exploitation is cited.
Researcher notes
The key failure is unreliable cleanup after a fcntl_setlk()/close() race. Cleanup may fail through differing LSM decisions or allocation failure during lock-range splitting. The resulting dangling lock is read through /proc/locks. The supplied description supports disclosure, not kernel-memory modification; the CVSS integrity and availability impacts are therefore not technically explained by the narrative.
Mitigation direction
- Apply vendor kernel updates incorporating the cited stable fixes.
- Consult distribution security guidance because patched package versions may differ from upstream versions.
- Prioritize shared systems allowing untrusted or low-privileged local users.
- Reduce unnecessary local account access until affected kernels are updated.
Validation and detection
- Inventory running kernel versions across Linux hosts.
- Check vendor advisories and package changelogs for CVE-2024-41012 or the cited fixes.
- Confirm updated kernels are running after maintenance.
- Do not rely solely on upstream version numbers when distributions use backported patches.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d30ff33040834c3b9eee29740acd92f9c7ba2250CVE reference, Linux
- https://git.kernel.org/stable/c/dc2ce1dfceaa0767211a9d963ddb029ab21c4235CVE reference, Linux
- https://git.kernel.org/stable/c/5661b9c7ec189406c2dde00837aaa4672efb6240CVE reference, Linux
- https://git.kernel.org/stable/c/52c87ab18c76c14d7209646ccb3283b3f5d87b22CVE reference, Linux
- https://git.kernel.org/stable/c/ef8fc41cd6f95f9a4a3470f085aecf350569a0b3CVE reference, Linux
- https://git.kernel.org/stable/c/5f5d0799eb0a01d550c21b7894e26b2d9db55763CVE reference, Linux
- https://git.kernel.org/stable/c/b6d223942c34057fdfd8f149e763fa823731b224CVE reference, Linux
- https://git.kernel.org/stable/c/3cad1bc010416c6dd780643476bc59ed742436b9CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.