PT-2024-36879 · Linux+3 · Linux Kernel+3
Published
2024-10-13
·
Updated
2025-05-26
·
CVE-2024-56573
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability has been resolved in the Linux kernel, specifically in efi/libstub, where the correct pointer is freed on failure. The
cmdline ptr is an out parameter that is not allocated by the function itself and likely points into the caller's stack. The cmdline refers to the pool allocation that should be freed when cleaning up after a failure, and it should be passed to free pool() instead.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Suse
Ubuntu