CVE-2024-56573CWE-763

CVE-2024-56573

High · published December 27, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

efi/libstub: Free correct pointer on failure

cmdline_ptr is an out parameter, which is not allocated by the function

itself, and likely points into the caller's stack.

cmdline refers to the pool allocation that should be freed when cleaning

up after a failure, so pass this instead to free_pool().

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-763 · Release of Invalid Pointer or Reference
Published
2024-12-27T20:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 6.2, < 6.6.646.6.64
linux/linux_kernel≥ 6.7, < 6.12.46.12.4
References (3)
https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 27 DEC 14:23Z
    efi/libstub: Free correct pointer on failure
    cvelistv5