Riskcovery

CVE-2024-47732

crypto: iaa - Fix potential use after free bug

State
Published
Severity
7.0 High
Published
Oct 21, 2024
Updated
Aug 5, 2026
Reserved
Sep 30, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the ->free() function and the use after free happens in dead code. But, with this fix, when something does implement it, we'll be ready. :)

Scores

CVSSScoreVectorSource
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b190447e0fa3ef7355480d641d078962e03768b4 to before b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9Affected
  • b190447e0fa3ef7355480d641d078962e03768b4 to before c66f0be993ba52410edab06124c54ecf143b05c1Affected
  • b190447e0fa3ef7355480d641d078962e03768b4 to before e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.10.13 through 6.10.*Not affected
  • 6.11.2 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.