CVE-2024-27392
nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
When nvme_identify_ns() fails, it frees the pointer to the struct
nvme_id_ns before it returns. However, ns_update_nuse() calls kfree()
for the pointer even when nvme_identify_ns() fails. This results in
KASAN double-free, which was observed with blktests nvme/045 with
proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by
skipping kfree() when nvme_identify_ns() fails.
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nvme: host: corrige la doble liberación de la estructura nvme_id_ns en ns_update_nuse() Cuando nvme_identify_ns() falla, libera el puntero a la estructura nvme_id_ns antes de que regrese. Sin embargo, ns_update_nuse() llama a kfree() para el puntero incluso cuando nvme_identify_ns() falla. Esto da como resultado KASAN double-free, que se observó con blktests nvme/045 con parches propuestos [1] en el kernel v6.8-rc7. Corrija el doble libre omitiendo kfree() cuando falla nvme_identify_ns().
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-25 CVE Reserved
- 2024-05-01 CVE Published
- 2024-05-02 EPSS Updated
- 2024-09-11 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/a1a825ab6a60380240ca136596732fdb80bad87a | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb | 2024-03-26 | |
| https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3 | 2024-03-06 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.8 < 6.8.2 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.8 < 6.8.2" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.8 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.8 < 6.9" | en |
Affected
| ||||||