CVE-2024-27413: efi/capsule-loader: fix incorrect allocation size
In the Linux kernel, the following vulnerability has been resolved:
efi/capsule-loader: fix incorrect allocation size
gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit physaddrt:
drivers/firmware/efi/capsule-loader.c: In function 'eficapsuleopen': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'physaddrt' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | capinfo->phys = kzalloc(sizeof(void ), GFPKERNEL); | ^
Use the correct type instead here.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27413?
CVE-2024-27413 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27413?
To fix CVE-2024-27413, update the Linux kernel to one of the patched versions: 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What is the impact of CVE-2024-27413?
CVE-2024-27413 can lead to incorrect memory allocation, potentially resulting in system instability or security issues.
Which systems are affected by CVE-2024-27413?
CVE-2024-27413 affects various versions of the Linux kernel used in Debian-based systems.
When was CVE-2024-27413 reported?
CVE-2024-27413 was reported and addressed in 2024 as part of ongoing kernel security improvements.