CVE-2024-0217: Packagekitd: use-after-free in idle function callback

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-03 · updated 2026-06-17
Weakness: CWE-416

Description

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

Affected products

Fedoraproject Fedora: 39
PackageKit: before 1.2.7 — fixed in 1.2.7
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: PackageKit 1.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-0217 or the next vulnerability affects your stack