CVE-2024-36890: mm/slab: make __free(kfree) accept error pointers
In the Linux kernel, the following vulnerability has been resolved:
mm/slab: make free(kfree) accept error pointers
Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831xgpiodbgshow().
171 char label free(kfree) = gpiochipduplinelabel(chip, i); 172 if (ISERR(label)) { 173 deverr(wm831x->dev, "Failed to duplicate label\n"); 174 continue; 175 }
The auto clean up function should check for error pointers as well, otherwise we're going to keep hitting issues like this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36890?
CVE-2024-36890 has a high severity due to the potential for system crashes.
How do I fix CVE-2024-36890?
To fix CVE-2024-36890, ensure that you upgrade to one of the patched versions of the Linux kernel listed in the affected software section.
Which versions of the Linux kernel are affected by CVE-2024-36890?
CVE-2024-36890 affects several Linux kernel versions prior to the fixed versions, including those below 5.10.223-1 and various 6.x versions.
What causes CVE-2024-36890?
CVE-2024-36890 is caused by improper handling of error pointers in the Linux kernel's memory management functions.
Is CVE-2024-36890 exploitable?
Yes, CVE-2024-36890 is exploitable under certain conditions, leading to system instability or crashes.