CVE-2024-50215

EPSS 0.63%
Veröffentlicht 09.11.2024 11:15:06
Zuletzt bearbeitet 04.08.2026 11:21:33
Erkennungen
Login

nvmet-auth: assign dh_key to NULL after kfree_sensitive

In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: assign dh_key to NULL after kfree_sensitive

ctrl->dh_key might be used across multiple calls to nvmet_setup_dhgroup()
for the same controller. So it's better to nullify it after release on
error path in order to avoid double free later in nvmet_destroy_auth().

Found by Linux Verification Center (linuxtesting.org) with Svace.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 8

NVD 8 VulnDex Vulnerability Enrichment 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version >= 6.0 < 6.1.116

Linux ≫ Linux Kernel Version >= 6.2 < 6.6.60

Linux ≫ Linux Kernel Version >= 6.7 < 6.11.7

Linux ≫ Linux Kernel Version 6.12 Update rc1

Linux ≫ Linux Kernel Version 6.12 Update rc2

Linux ≫ Linux Kernel Version 6.12 Update rc3

Linux ≫ Linux Kernel Version 6.12 Update rc4

Linux ≫ Linux Kernel Version 6.12 Update rc5

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.63%	0.472

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H