fkie_nvd - fkie_cve-2024-56573

fkie_cve-2024-56573

Vulnerability from fkie_nvd

Published

2024-12-27 15:15

Modified

2024-12-27 15:15

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: efi/libstub: Free correct pointer on failure cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack. cmdline refers to the pool allocation that should be freed when cleaning up after a failure, so pass this instead to free_pool().

References

▼	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/libstub: Free correct pointer on failure\n\ncmdline_ptr is an out parameter, which is not allocated by the function\nitself, and likely points into the caller\u0027s stack.\n\ncmdline refers to the pool allocation that should be freed when cleaning\nup after a failure, so pass this instead to free_pool()."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: efi/libstub: Liberar puntero correcto en caso de falla cmdline_ptr es un par\u00e1metro de salida, que no es asignado por la funci\u00f3n en s\u00ed, y probablemente apunta a la pila del llamador. cmdline se refiere a la asignaci\u00f3n del grupo que se debe liberar al limpiar despu\u00e9s de una falla, as\u00ed que p\u00e1selo en su lugar a free_pool()."
    }
  ],
  "id": "CVE-2024-56573",
  "lastModified": "2024-12-27T15:15:16.320",
  "metrics": {},
  "published": "2024-12-27T15:15:16.320",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

cve-2024-56573

Vulnerability from cvelistv5

Published

2024-12-27 14:23

Modified

2025-01-20 06:23

Severity ?

Summary

References

▼	URL	Tags
	https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a
	https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf
	https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847

Impacted products

Vendor

Product

Version

▼

Linux

Version: 42c8ea3dca094ab82776ca706fb7a9cbe8ac3dc9
Version: 42c8ea3dca094ab82776ca706fb7a9cbe8ac3dc9
Version: 42c8ea3dca094ab82776ca706fb7a9cbe8ac3dc9

Linux

Version: 6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/efi/libstub/efi-stub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d173aee5709bd0994d216d60589ec67f8b11376a",
              "status": "affected",
              "version": "42c8ea3dca094ab82776ca706fb7a9cbe8ac3dc9",
              "versionType": "git"
            },
            {
              "lessThan": "eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf",
              "status": "affected",
              "version": "42c8ea3dca094ab82776ca706fb7a9cbe8ac3dc9",
              "versionType": "git"
            },
            {
              "lessThan": "06d39d79cbd5a91a33707951ebf2512d0e759847",
              "status": "affected",
              "version": "42c8ea3dca094ab82776ca706fb7a9cbe8ac3dc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/efi/libstub/efi-stub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/libstub: Free correct pointer on failure\n\ncmdline_ptr is an out parameter, which is not allocated by the function\nitself, and likely points into the caller\u0027s stack.\n\ncmdline refers to the pool allocation that should be freed when cleaning\nup after a failure, so pass this instead to free_pool()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:23:20.837Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847"
        }
      ],
      "title": "efi/libstub: Free correct pointer on failure",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56573",
    "datePublished": "2024-12-27T14:23:16.231Z",
    "dateReserved": "2024-12-27T14:03:05.998Z",
    "dateUpdated": "2025-01-20T06:23:20.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted