CVE-2024-49852: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
In the Linux kernel, the following vulnerability has been resolved:
scsi: elx: libefc: Fix potential use after free in efcnportvportdel()
The krefput() function will call nport->release if the refcount drops to zero. The nport->release release function is efcnportfree() which frees "nport". But then we dereference "nport" on the next line which is a use after free. Re-order these lines to avoid the use after free.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49852?
CVE-2024-49852 is classified as a medium severity vulnerability in the Linux Kernel.
How do I fix CVE-2024-49852?
To fix CVE-2024-49852, users should upgrade their Linux Kernel to the latest stable version that includes the security patch.
What versions of Linux Kernel are affected by CVE-2024-49852?
CVE-2024-49852 affects multiple Linux Kernel versions from 5.14 up to before 5.15.168 and several versions within the 5.16 to 6.6 range.
Is CVE-2024-49852 a remote vulnerability?
CVE-2024-49852 does not explicitly indicate that it is a remote vulnerability but may allow for local privilege escalation.
Who is responsible for the fix for CVE-2024-49852?
The Linux kernel development community is responsible for addressing and fixing CVE-2024-49852.