AZL-53084
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-53084.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-53084
- Upstream
- Published
- 2024-11-09T11:15:06Z
- Modified
- 2026-04-01T05:17:56.733655Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2024-50215 affecting package kernel for versions less than 6.6.64.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: assign dhkey to NULL after kfreesensitive
ctrl->dhkey might be used across multiple calls to nvmetsetupdhgroup() for the same controller. So it's better to nullify it after release on error path in order to avoid double free later in nvmetdestroy_auth().
Found by Linux Verification Center (linuxtesting.org) with Svace.
- References