Security readout for executives and security teams
Plain-English summary
CVE-2024-53170 is a Linux kernel memory-safety flaw in the block layer. A local user or local code path could potentially trigger use-after-free behavior during block/SCSI queue handling, with high impact to confidentiality, integrity, and availability. No provided source shows active exploitation.
Executive priority
Patch in the normal high-priority kernel maintenance lane, faster for shared infrastructure or systems running untrusted local workloads. Business urgency comes from potential full local compromise impact, balanced by lack of confirmed active exploitation in the provided sources.
Technical view
The issue is a CWE-416 use-after-free involving flush request mappings left in tags->rqs[] when blk_mq_destroy_queue() follows del_gendisk() after QUEUE_FLAG_INIT_DONE is cleared. Syzkaller found the bug in Linux 6.6 during blk_mq_timeout_work while iterating busy tags.
Likely exposure
Exposure is most relevant to systems running affected Linux kernel versions or vendor backports that have not incorporated the stable block-layer fixes. The CVE data lists Linux as affected across several kernel lines and includes Debian LTS and Siemens advisories for downstream tracking.
Exploitation context
The CVSS vector is local, low complexity, low privileges, and no user interaction. The source bundle does not include a public exploit, exploitation report, or CISA KEV listing. Treat this as a serious local kernel privilege-risk issue, not confirmed internet-scale exploitation.
Researcher notes
Validation should focus on kernel lineage and backport status, not only upstream version strings. The vulnerable area is block multiqueue tag iteration after SCSI/disk teardown, where stale flush request mappings can be dereferenced by timeout work.
Mitigation direction
- Apply kernel updates that include the referenced Linux stable fixes.
- Check Debian LTS and Siemens advisories if those vendors apply to your environment.
- Prioritize shared, multi-user, and workload-hosting Linux systems.
- Use vendor-supported kernels rather than ad hoc patch selection.
- If updates are unavailable, follow vendor guidance for compensating controls.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and images.
- Compare running kernels against vendor advisories and the CVE affected data.
- Confirm installed packages include a backport or referenced stable fix.
- Review kernel logs for block, SCSI, timeout, or use-after-free crashes.
- Track exceptions until the responsible vendor publishes corrected builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53170 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1921fe7d2836f8be1d321cf430d17e0d4e05301bCVE reference, Linux
- https://git.kernel.org/stable/c/1364a29b71c7837770f1902c49e7a6e234d72c92CVE reference, Linux
- https://git.kernel.org/stable/c/a0e93b9fefafe97d596f9c98701ae6c3b04b3ff6CVE reference, Linux
- https://git.kernel.org/stable/c/61092568f2a9acb0e6e186f03f2e0649a4e86d09CVE reference, Linux
- https://git.kernel.org/stable/c/3802f73bd80766d70f319658f334754164075bc3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.