CVE-2024-33619: efi: libstub: only free priv.runtime_map when allocated
In the Linux kernel, the following vulnerability has been resolved:
efi: libstub: only free priv.runtimemap when allocated
priv.runtimemap is only allocated when efinovamap is not set. Otherwise, it is an uninitialized value. In the error path, it is freed unconditionally. Avoid passing an uninitialized value to freepool. Free priv.runtimemap only when it was allocated.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33619?
CVE-2024-33619 is categorized as a medium severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2024-33619?
To address CVE-2024-33619, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
Which Linux distributions are affected by CVE-2024-33619?
CVE-2024-33619 affects Debian Linux systems that utilize the vulnerable kernel versions.
What components are impacted by CVE-2024-33619?
CVE-2024-33619 specifically affects the efi libstub component in the Linux kernel.
Is there any exploit available for CVE-2024-33619?
As of now, there are no known public exploits specifically targeting CVE-2024-33619.