CVE-2024-50215: nvmet-auth: assign dh_key to NULL after kfree_sensitive
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: assign dhkey to NULL after kfreesensitive
ctrl->dhkey might be used across multiple calls to nvmetsetupdhgroup() for the same controller. So it's better to nullify it after release on error path in order to avoid double free later in nvmetdestroyauth().
Found by Linux Verification Center (linuxtesting.org) with Svace.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: assign dhkey to NULL after kfreesensitive
ctrl->dhkey might be used across multiple calls to nvmetsetupdhgroup() for the same controller. So it's better to nullify it after release on error path in order to avoid double free later in nvmetdestroyauth().
Found by Linux Verification Center (linuxtesting.org) with Svace.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50215?
CVE-2024-50215 has a moderate severity level due to potential information leakage and denial of service risks.
How do I fix CVE-2024-50215?
To fix CVE-2024-50215, update your Linux kernel to a version that includes the patch, specifically versions after 6.1.116, 6.6.60, or 6.11.7.
Which versions of the Linux kernel are affected by CVE-2024-50215?
CVE-2024-50215 affects Linux kernel versions from 6.0 up to 6.1.116, from 6.2 up to 6.6.60, and from 6.7 up to 6.11.7, including specific release candidates.
What components are impacted by CVE-2024-50215?
CVE-2024-50215 impacts components related to the nvmet-auth function in the Linux kernel, particularly during the handling of the dh_key.
Is CVE-2024-50215 common in Linux distributions?
Yes, CVE-2024-50215 is a common vulnerability found across various Linux distributions that utilize affected kernel versions.