CVE-2024-56766: mtd: rawnand: fix double free in atmel_pmecc_create_user()
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: fix double free in atmelpmecccreateuser()
The "user" pointer was converted from being allocated with kzalloc() to being allocated by devmkzalloc(). Calling kfree(user) will lead to a double free.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.76.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.176.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56766?
CVE-2024-56766 is considered a moderate severity vulnerability due to the potential for a double free condition in the Linux kernel.
How do I fix CVE-2024-56766?
To fix CVE-2024-56766, update your Linux kernel to a version that contains the patch addressing this vulnerability.
Which Linux kernel versions are affected by CVE-2024-56766?
CVE-2024-56766 affects Linux kernel versions between 4.19.325 and 4.20, as well as certain versions from 5.4.287 up to 5.16 and others.
What component of the Linux kernel is affected by CVE-2024-56766?
CVE-2024-56766 specifically affects the mtd (Memory Technology Device) subsystem in the Linux kernel.
Can CVE-2024-56766 be exploited remotely?
CVE-2024-56766 does not appear to be exploitable remotely, as it requires local access to trigger the vulnerability.