CVE-2024-46716CWE-416

CVE-2024-46716

High · published September 18, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor

Remove list_del call in msgdma_chan_desc_cleanup, this should be the role

of msgdma_free_descriptor. In consequence replace list_add_tail with

list_move_tail in msgdma_free_descriptor.

This fixes the path:

msgdma_free_chan_resources -> msgdma_free_descriptors ->

msgdma_free_desc_list -> msgdma_free_descriptor

which does not correctly free the descriptors as first nodes were not

removed from the list.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00227 · 12.7th percentile
Weakness
CWE-416 · Use After Free
Published
2024-09-18T11:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel< 6.1.1096.1.109
linux/linux_kernel≥ 6.2, < 6.6.506.6.50
linux/linux_kernel≥ 6.7, < 6.10.96.10.9
References (5)
EPSS history
Timeline
  • 18 SEP 06:32Z
    dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
    cvelistv5