Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-27392
HistoryMay 01, 2024 - 12:00 a.m.

CVE-2024-27392

2024-05-0100:00:00
ubuntu.com
ubuntu.com
9
linux kernel
nvme host
vulnerability
double-free
struct nvme_id_ns
ns_update_nuse
kasan double-free
blktests
proposed patches
kernel v6.8-rc7
skip kfree()

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

In the Linux kernel, the following vulnerability has been resolved: nvme:
host: fix double-free of struct nvme_id_ns in ns_update_nuse() When
nvme_identify_ns() fails, it frees the pointer to the struct nvme_id_ns
before it returns. However, ns_update_nuse() calls kfree() for the pointer
even when nvme_identify_ns() fails. This results in KASAN double-free,
which was observed with blktests nvme/045 with proposed patches [1] on the
kernel v6.8-rc7. Fix the double-free by skipping kfree() when
nvme_identify_ns() fails.

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%