CVE-2024-42138: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: corelinecards: Fix double memory deallocation in case of invalid INI file
In case of invalid INI file mlxswlinecardtypesinit() deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after mlxswlinecardtypesinit() call, mlxswlinecardsinit() calls mlxswlinecardtypesfini() which performs memory deallocation again.
Add pointer reset to NULL.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42138?
CVE-2024-42138 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-42138?
To fix CVE-2024-42138, update to a patched version of the Linux kernel, such as 5.10.223-1, 6.1.128-1, or later.
What systems are affected by CVE-2024-42138?
CVE-2024-42138 affects various versions of the Linux kernel, particularly those between 5.10 and 6.12.
What are the risks of leaving CVE-2024-42138 unpatched?
Leaving CVE-2024-42138 unpatched could lead to potential memory corruption issues that may be exploited by an attacker.
What is the nature of the vulnerability in CVE-2024-42138?
CVE-2024-42138 involves a double memory deallocation that occurs if an invalid INI file is processed.