CVE-2024-26824

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26824
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - Remove bogus SGL free on zero-length error path When a zero-length message is hashed by algif_hash, and an error is triggered, it tries to free an SG list that was never allocated in the first place. Fix this by not freeing the SG list on the zero-length error path.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 Patch
https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 Patch
https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 Patch
https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 Patch
https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 Patch
https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
History

27 Mar 2025, 20:56

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 - () https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 - Patch
References () https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 - () https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 - Patch
References () https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 - () https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 - Patch

21 Nov 2024, 09:03

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: crypto: algif_hash - Eliminar SGL falso libre en ruta de error de longitud cero Cuando algif_hash codifica un mensaje de longitud cero y se activa un error, intenta liberar una lista de SG que nunca fue asignado en primer lugar. Solucione este problema al no liberar la lista SG en la ruta de error de longitud cero.
References () https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 - () https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 -
References () https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 - () https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 -
References () https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 - () https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 -

17 Apr 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 10:15

Updated : 2025-03-27 20:56

NVD link : CVE-2024-26824

Mitre link : CVE-2024-26824

CVE.ORG link : CVE-2024-26824

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo