CVE-2024-27392: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
In the Linux kernel, the following vulnerability has been resolved:
nvme: host: fix double-free of struct nvmeidns in nsupdatenuse()
When nvmeidentifyns() fails, it frees the pointer to the struct nvmeidns before it returns. However, nsupdatenuse() calls kfree() for the pointer even when nvmeidentifyns() fails. This results in KASAN double-free, which was observed with blktests nvme/045 with proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by skipping kfree() when nvmeidentifyns() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27392?
CVE-2024-27392 has a high severity level due to its potential to cause double-free vulnerabilities in the Linux kernel.
What does CVE-2024-27392 affect?
CVE-2024-27392 affects specific versions of the Linux kernel, particularly between versions 6.0 and 6.8.2.
How do I fix CVE-2024-27392?
To fix CVE-2024-27392, update your Linux kernel to one of the patched versions, such as 5.10.223-1, 6.1.123-1, or later.
What type of vulnerability is CVE-2024-27392?
CVE-2024-27392 is classified as a double-free vulnerability which occurs in the nvme driver of the Linux kernel.
Is CVE-2024-27392 exploitable remotely?
While the specifics of exploitation depend on system configuration, CVE-2024-27392 may potentially be exploited remotely under certain conditions.