CVE-2024-27392

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27392
In the Linux kernel, the following vulnerability has been resolved: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse() When nvme_identify_ns() fails, it frees the pointer to the struct nvme_id_ns before it returns. However, ns_update_nuse() calls kfree() for the pointer even when nvme_identify_ns() fails. This results in KASAN double-free, which was observed with blktests nvme/045 with proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by skipping kfree() when nvme_identify_ns() fails.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb Patch
https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 Patch
https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb Patch
https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

26 Dec 2024, 20:32

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-415
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb - () https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb - Patch
References () https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 - () https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 - Patch

21 Nov 2024, 09:04

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nvme: host: corrige la doble liberación de la estructura nvme_id_ns en ns_update_nuse() Cuando nvme_identify_ns() falla, libera el puntero a la estructura nvme_id_ns antes de que regrese. Sin embargo, ns_update_nuse() llama a kfree() para el puntero incluso cuando nvme_identify_ns() falla. Esto da como resultado KASAN double-free, que se observó con blktests nvme/045 con parches propuestos [1] en el kernel v6.8-rc7. Corrija el doble libre omitiendo kfree() cuando falla nvme_identify_ns().
References () https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb - () https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb -
References () https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 - () https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 -

01 May 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-01 13:15

Updated : 2024-12-26 20:32

NVD link : CVE-2024-27392

Mitre link : CVE-2024-27392

CVE.ORG link : CVE-2024-27392

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free