CVE-2024-50159: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Fix the double free in scmidebugfscommonsetup()
Clang static checker(scan-build) throws below warning： | drivers/firmware/armscmi/driver.c:line 2915, column 2 | Attempt to free released memory.
When devmaddactionorreset() fails, scmidebugfscommoncleanup() will run twice which causes double free of 'dbg->name'.
Remove the redundant scmidebugfscommoncleanup() to fix this problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
In scmi_debugfs_common_setup(), remove the redundant scmi_debugfs_common_cleanup() so that when devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup() does not run twice and double free 'dbg->name'.
Linux kernel (drivers/firmware/arm_scmi) Remove redundant scmi_debugfs_common_cleanup() call = Remove the redundant scmi_debugfs_common_cleanup() to fix the problem
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50159?
CVE-2024-50159 is a medium severity vulnerability in the Linux kernel due to a double free issue.
How do I fix CVE-2024-50159?
To fix CVE-2024-50159, you should upgrade to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50159?
CVE-2024-50159 affects versions of the Linux kernel from 6.3 to 6.6.59 and 6.7 to 6.11.6, as well as the release candidates 6.12-rc1, 6.12-rc2, and 6.12-rc3.
What components are impacted by CVE-2024-50159?
CVE-2024-50159 impacts the firmware component related to arm_scmi in the Linux kernel.
Is CVE-2024-50159 exploitable remotely?
There is no evidence that CVE-2024-50159 is remotely exploitable; it requires local access to trigger the vulnerability.