CVE-2024-43913

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43913
In the Linux kernel, the following vulnerability has been resolved: nvme: apple: fix device reference counting Drivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl. Split the allocation side out to make the error handling boundary easier to navigate. The apple driver had been doing this wrong, leaking the controller device memory on a tagset failure.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/b9ecbfa45516182cd062fecd286db7907ba84210 Patch
https://git.kernel.org/stable/c/d59c4d0eb6adc24c2201f153ccb7fd0a335b0d3d Patch
https://git.kernel.org/stable/c/f7d9a18572fcd7130459b7691bd19ee2a2e951ad
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

09 Dec 2024, 13:10

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/f7d9a18572fcd7130459b7691bd19ee2a2e951ad -

05 Sep 2024, 18:12

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/b9ecbfa45516182cd062fecd286db7907ba84210 - () https://git.kernel.org/stable/c/b9ecbfa45516182cd062fecd286db7907ba84210 - Patch
References () https://git.kernel.org/stable/c/d59c4d0eb6adc24c2201f153ccb7fd0a335b0d3d - () https://git.kernel.org/stable/c/d59c4d0eb6adc24c2201f153ccb7fd0a335b0d3d - Patch
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nvme: apple: corrige el recuento de referencias del dispositivo Los controladores deben llamar a nvme_uninit_ctrl después de un nvme_init_ctrl exitoso. Divida el lado de la asignación para que sea más fácil navegar por el límite de manejo de errores. El controlador de Apple había estado haciendo esto mal, perdiendo la memoria del dispositivo controlador debido a una falla en el conjunto de etiquetas.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

26 Aug 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-26 11:15

Updated : 2024-12-09 13:10

NVD link : CVE-2024-43913

Mitre link : CVE-2024-43913

CVE.ORG link : CVE-2024-43913

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime