CVE-2024-36973: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
In the Linux kernel, the following vulnerability has been resolved:
misc: microchip: pci1xxxx: fix double free in the error handling of gpauxbusprobe()
When auxiliarydeviceadd() returns error and then calls auxiliarydeviceuninit(), callback function gpauxiliarydevicerelease() calls idafree() and kfree(auxdevicewrapper) to free memory. We should't call them again in the error handling path.
Fix this by skipping the redundant cleanup functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36973?
CVE-2024-36973 has not been assigned a specific CVSS score yet, but it is categorized as a vulnerability in the Linux kernel.
How do I fix CVE-2024-36973?
To fix CVE-2024-36973, update the Linux kernel to version 6.1.123-1, 6.1.128-1, 6.12.12-1, or newer versions that address this bug.
Which versions of the Linux kernel are affected by CVE-2024-36973?
CVE-2024-36973 affects Linux kernel versions from 6.1 to 6.10-rc3, including various intermediate versions.
What type of vulnerability is CVE-2024-36973?
CVE-2024-36973 is a double free vulnerability occurring in the error handling process of the gp_aux_bus_probe function.
Is CVE-2024-36973 exploitable?
While specific exploitability details are not provided, double free vulnerabilities typically pose a risk of memory corruption which can lead to further exploitation.