CyberRota Analysis
AI-GeneratedOpenPrinting CUPS versions prior to 2.4.20 are vulnerable to a double-free error in printer-class management, which can lead to a denial of service if a client with the appropriate permissions modifies or deletes class members. This flaw allows the potential for scheduler-wide disruptions due to improper memory handling. Organizations using CUPS for printer management, especially those with clients that have @SYSTEM privileges, should prioritize addressing this vulnerability to mitigate service interruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.