7.8

CVE-2024-56766

In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: fix double free in atmel_pmecc_create_user()

The "user" pointer was converted from being allocated with kzalloc() to
being allocated by devm_kzalloc().  Calling kfree(user) will lead to a
double free.
Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.19.325 < 4.20
Linux ≫ Linux Kernel Version >= 5.4.287 < 5.5
Linux ≫ Linux Kernel Version >= 5.10.231 < 5.11
Linux ≫ Linux Kernel Version >= 5.15.174 < 5.16
Linux ≫ Linux Kernel Version >= 6.1.120 < 6.1.123
Linux ≫ Linux Kernel Version >= 6.6.64 < 6.6.69
Linux ≫ Linux Kernel Version >= 6.11.11 < 6.12
Linux ≫ Linux Kernel Version >= 6.12.2 < 6.12.8
Linux ≫ Linux Kernel Version6.13 Updaterc1
Linux ≫ Linux Kernel Version6.13 Updaterc2
Linux ≫ Linux Kernel Version6.13 Updaterc3
Linux ≫ Linux Kernel Version6.13 Updaterc4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.137
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.