CVE-2024-49852

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-49852
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() The kref_put() function will call nport->release if the refcount drops to zero. The nport->release release function is _efc_nport_free() which frees "nport". But then we dereference "nport" on the next line which is a use after free. Re-order these lines to avoid the use after free.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/16a570f07d870a285b0c0b0d1ca4dff79e8aa5ff Patch
https://git.kernel.org/stable/c/2e4b02fad094976763af08fec2c620f4f8edd9ae Patch
https://git.kernel.org/stable/c/7c2908985e4ae0ea1b526b3916de9e5351650908 Patch
https://git.kernel.org/stable/c/98752fcd076a8cbc978016eae7125b4971be1eec Patch
https://git.kernel.org/stable/c/abc71e89170ed32ecf0a5a29f31aa711e143e941 Patch
https://git.kernel.org/stable/c/baeb8628ab7f4577740f00e439d3fdf7c876b0ff Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Oct 2024, 16:14

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/16a570f07d870a285b0c0b0d1ca4dff79e8aa5ff - () https://git.kernel.org/stable/c/16a570f07d870a285b0c0b0d1ca4dff79e8aa5ff - Patch
References () https://git.kernel.org/stable/c/2e4b02fad094976763af08fec2c620f4f8edd9ae - () https://git.kernel.org/stable/c/2e4b02fad094976763af08fec2c620f4f8edd9ae - Patch
References () https://git.kernel.org/stable/c/7c2908985e4ae0ea1b526b3916de9e5351650908 - () https://git.kernel.org/stable/c/7c2908985e4ae0ea1b526b3916de9e5351650908 - Patch
References () https://git.kernel.org/stable/c/98752fcd076a8cbc978016eae7125b4971be1eec - () https://git.kernel.org/stable/c/98752fcd076a8cbc978016eae7125b4971be1eec - Patch
References () https://git.kernel.org/stable/c/abc71e89170ed32ecf0a5a29f31aa711e143e941 - () https://git.kernel.org/stable/c/abc71e89170ed32ecf0a5a29f31aa711e143e941 - Patch
References () https://git.kernel.org/stable/c/baeb8628ab7f4577740f00e439d3fdf7c876b0ff - () https://git.kernel.org/stable/c/baeb8628ab7f4577740f00e439d3fdf7c876b0ff - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: elx: libefc: Se corrige el potencial use after freea nport->release si el recuento de referencias cae a cero. La función de liberación nport->release es _efc_nport_free() que libera "nport". Pero luego desreferenciamos "nport" en la siguiente línea que es un use after free. Reordena estas líneas para evitar el use after free.
CWE CWE-416
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux

21 Oct 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 13:15

Updated : 2024-10-23 16:14

NVD link : CVE-2024-49852

Mitre link : CVE-2024-49852

CVE.ORG link : CVE-2024-49852

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free