Log in Start free

Vulnerability · Published Apr 17, 2024 · Assigned by Linux

CVE-2024-26824crypto: algif_hash - Remove bogus SGL free on zero-length error path

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - Remove bogus SGL free on zero-length error path When a zero-length message is hashed by algif_hash, and an error is triggered, it tries to free an SG list that was never allocated in the first place. Fix this by not freeing the SG list on the zero-length error path.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.7.7-1DEBIAN-CVE-2024-26824
Debian:14linux6.7.7-1DEBIAN-CVE-2024-26824
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-aws-6.56.5.0-1023.23~22.04.1UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-azure-6.56.5.0-1024.25~22.04.1UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-gcp-6.56.5.0-1024.26~22.04.1UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-hwe-6.56.5.0-44.44~22.04.1UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.56.5.0-44.44.1~22.04.1UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1023.24UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-oem-6.56.5.0-1027.28UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-oracle-6.56.5.0-1026.26~22.04.1UBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-26824
Ubuntu:22.04:LTSlinux-starfive-6.56.5.0-1017.18~22.04.1UBUNTU-CVE-2024-26824

Affected products (as reported)

VendorProductVersions
Linux Linux b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4 – before 9c82920359b7c1eddaf72069bcfe0ffddf088cd0b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4 – before 775f3c1882a493168e08fdb8cde0865c8f3a8a29b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4 – before 24c890dd712f6345e382256cae8c97abb0406b70
Linux Linux 6.5

References