CVE-2024-36844: Use After Free
libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libmodbusto a version that resolves this vulnerability.Fixed in 3.1.6-2.1 - Upgrade
Upgrade
debian/libmodbusto a version that resolves this vulnerability.Fixed in 3.1.6-2.1Fixed in 3.1.6-2.1+deb12u1Fixed in 3.1.11-2Fixed in 3.2.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36844?
CVE-2024-36844 has a severity rating that indicates it can lead to Denial of Service (DoS).
How do I fix CVE-2024-36844?
To fix CVE-2024-36844, update to the latest version of libmodbus that addresses this vulnerability.
What can an attacker achieve with CVE-2024-36844?
An attacker can exploit CVE-2024-36844 to cause a Denial of Service by sending a crafted message to the unit-test-server.
Which version of libmodbus is affected by CVE-2024-36844?
CVE-2024-36844 affects libmodbus version 3.1.6.
What is a use-after-free vulnerability in the context of CVE-2024-36844?
A use-after-free vulnerability, like CVE-2024-36844, occurs when a program continues to use a memory location after it has been freed, potentially leading to crashes or unexpected behavior.