CVE-2024-36967

KEYS: trusted: Fix memory leak in tpm2_key_encode()

Description

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2_key_encode() 'scratch' is never freed. Fix this by calling kfree() in the success, and in the error case.

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.05%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/1e6914fa8e7798bcf3ce4a5b96ea4ac1d5571cdf patch
https://git.kernel.org/stable/c/5d91238b590bd883c86ba7707c5c9096469c08b7 patch
https://git.kernel.org/stable/c/e62835264d0352be6086975f18fdfed2b5520b13 patch
https://git.kernel.org/stable/c/189c768932d435045b1fae12bf63e53866f06a28 patch
https://git.kernel.org/stable/c/cf26a92f560eed5d6ddc3d441cc645950cbabc56 patch
https://git.kernel.org/stable/c/ffcaa2172cc1a85ddb8b783de96d38ca8855e248 patch

Frequently Asked Questions

What is the severity of CVE-2024-36967?
CVE-2024-36967 has been scored as a medium severity vulnerability.
How to fix CVE-2024-36967?
To fix CVE-2024-36967, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-36967 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-36967 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-36967?
CVE-2024-36967 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.