CVE-2024-56573

efi/libstub: Free correct pointer on failure

Description

In the Linux kernel, the following vulnerability has been resolved: efi/libstub: Free correct pointer on failure cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack. cmdline refers to the pool allocation that should be freed when cleaning up after a failure, so pass this instead to free_pool().

N/A

CVSS

Severity:

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a
https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf
https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847

Frequently Asked Questions

What is the severity of CVE-2024-56573?: CVE-2024-56573 has not yet been assigned a CVSS score.
How to fix CVE-2024-56573?: To fix CVE-2024-56573, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-56573 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-56573 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-56573?: CVE-2024-56573 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.