mtd: rawnand: fix double free in atmel_pmecc_create_user() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 13 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free.
Faiblesses (CWE)
- CWE-415 — Double libération
Références
- https://git.kernel.org/stable/c/ca9818554b0f33e87f38e4bfa2dac056692d46cc
- https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e
- https://git.kernel.org/stable/c/3d825a241e65f7e3072978729e79d735ec40b80e
- https://git.kernel.org/stable/c/6ea15205d7e2b811fbbdf79783f686f58abfb4b7
- https://git.kernel.org/stable/c/dd45c87782738715d5e7c167f8dabf0814a7394a
- https://git.kernel.org/stable/c/d2f090ea57f8d6587e09d4066f740a8617767b3d
- https://git.kernel.org/stable/c/d8e4771f99c0400a1873235704b28bb803c83d17
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-53409
- GCVE · GCVE-0-2024-56766
Avis du CERT-FR
- CERTFR-2025-AVI-0254 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0151 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0133 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0088 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.325 < 4.20cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.287 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.231 < 5.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.174 < 5.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.120 < 6.1.123cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.64 < 6.6.69cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.11.11 < 6.12cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.2 < 6.12.8cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 22fbbc37edb840fd420fadf670366be9bf028426 < ca9818554b0f33e87f38e4bfa2dac056692d46cc ; affected 54cb5fa850f9306d84e49a3db44b7a7eb5536cd1 < 1562871ef613fa9492aa0310933eff785166a90e ; affected 5fe7709251e334cc27618473299c48340cecd3c8 < 3d825a241e65f7e3072978729e79d735ec40b80e ; affected 24cbc37e837fd9e31e5024480b779207d1d99f1d < 6ea15205d7e2b811fbbdf79783f686f58abfb4b7 ; affected f1290871c8aaeb13029390a2b6e5c05733a1be6f < dd45c87782738715d5e7c167f8dabf0814a7394a ; affected 8ac19ec818c548c5788da5926dcc8af96fad4bb1 < d2f090ea57f8d6587e09d4066f740a8617767b3d |
| Linux · Linux | affected 5.4.287 < 5.4.289 ; affected 5.10.231 < 5.10.233 ; affected 5.15.174 < 5.15.176 ; affected 6.1.120 < 6.1.123 ; affected 6.6.64 < 6.6.69 ; affected 6.12.2 < 6.12.8 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |