CVE-2024-50159CWE-415

CVE-2024-50159

High · published November 7, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()

Clang static checker(scan-build) throws below warning：

| drivers/firmware/arm_scmi/driver.c:line 2915, column 2

| Attempt to free released memory.

When devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup()

will run twice which causes double free of 'dbg->name'.

Remove the redundant scmi_debugfs_common_cleanup() to fix this problem.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-415 · Double Free
Published
2024-11-07T15:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.3, < 6.6.596.6.59
linux/linux_kernel≥ 6.7, < 6.11.66.11.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
https://git.kernel.org/stable/c/39b13dce1a91cdfc3bec9238f9e89094551bd428 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d91d07913aee90556362d648d6a28a1eda419dc · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fb324fdaf546bf14bc4c17e0037bca6cb952b121 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 07 NOV 09:31Z
    firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
    cvelistv5