Riskcovery

CVE-2024-33619

efi: libstub: only free priv.runtime_map when allocated

State
Published
Severity
7.8 High
Published
Jun 21, 2024
Updated
Aug 5, 2026
Reserved
Jun 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

efi: libstub: only free priv.runtime_map when allocated

priv.runtime_map is only allocated when efi_novamap is not set. Otherwise, it is an uninitialized value. In the error path, it is freed unconditionally. Avoid passing an uninitialized value to free_pool. Free priv.runtime_map only when it was allocated.

This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f80d26043af91ceb5036c478101c015edb9e7630 to before b8938d6f570f010a1dcdbfed3e5b5d3258c2a908Affected
  • f80d26043af91ceb5036c478101c015edb9e7630 to before 9dce01f386c9ce6990c0a83fa14b1c95330b037eAffected
  • f80d26043af91ceb5036c478101c015edb9e7630 to before 6ca67a5fe1c606d1fbe24c30a9fc0bdc43a18554Affected
  • f80d26043af91ceb5036c478101c015edb9e7630 to before 4b2543f7e1e6b91cfc8dd1696e3cdf01c3ac8974Affected
LinuxLinux
  • 6.1Affected
  • before 6.1Not affected
  • 6.1.93 through 6.1.*Not affected
  • 6.6.33 through 6.6.*Not affected
  • 6.9.4 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.