CVE-2024-26930: linux-libc-dev - Fix double free of the ha->vp_map pointer
Summary
CVE-2024-26930: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling and linking programs against the Linux kernel. It is an essential component for building software that interacts with the kernel. The vulnerability in this package allows for a double free of the ha->vp_map pointer, which can lead to memory corruption and potential security issues.
Vulnerability Detail
The vulnerability in linux-libc-dev (CVE-2024-26930) arises from a double free of the ha->vp_map pointer. This pointer is freed in the qla2x00_mem_alloc() function and is mistakenly freed again in the qla2x00_mem_free(ha) function. This double free can result in memory corruption and may be exploited by an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the patch or update the linux-libc-dev package to mitigate the risk of exploitation.
Conclusion
The linux-libc-dev package is vulnerable to a double free issue, which can result in memory corruption and potential security risks. It is crucial to update the package to a patched version or apply the provided fix to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
Linux-libc-dev is a development package that provides header files and libraries for compiling programs against the Linux kernel.
The vulnerability allows for a double free of a pointer, which can lead to memory corruption and potential security issues. It may be exploited to execute arbitrary code or cause a denial of service.
To fix this vulnerability, update the linux-libc-dev package to a version that includes the fix. Refer to the provided Git commits for the specific fix.
No, there is no known workaround for this vulnerability. It is essential to apply the patch or update the package to mitigate the risk.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
