Log in Start free

Vulnerability · Published Nov 7, 2024 · Assigned by Linux

CVE-2024-50153scsi: target: core: Fix null-ptr-deref in target_alloc_device()

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 82.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.115-1DEBIAN-CVE-2024-50153
Debian:13linux6.11.6-1DEBIAN-CVE-2024-50153
Debian:14linux6.11.6-1DEBIAN-CVE-2024-50153
Ubuntu:22.04:LTSlinux5.15.0-133.144USN-7288-1
Ubuntu:22.04:LTSlinux5.15.0-133.144UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux6.8.0-58.60UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-aws5.15.0-1078.85USN-7308-1
Ubuntu:22.04:LTSlinux-aws5.15.0-1078.85UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-aws6.8.0-1027.29UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1027.29~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure5.15.0-1081.90UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure5.15.0-1081.90USN-7289-1
Ubuntu:24.04:LTSlinux-azure6.8.0-1027.32UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1027.32~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1081.90.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1081.90.1USN-7289-1
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1014.15UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gcp5.15.0-1077.86UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gcp5.15.0-1077.86USN-7291-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1028.30UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1028.30~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gke5.15.0-1075.81USN-7291-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1075.81UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-gke6.8.0-1023.27UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1060.68UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1060.68USN-7289-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1010.12UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-58.60~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-ibm5.15.0-1070.73UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-ibm5.15.0-1070.73USN-7289-3
Ubuntu:24.04:LTSlinux-ibm6.8.0-1024.24UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1024.24~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1073.79UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1073.79USN-7289-4
Ubuntu:22.04:LTSlinux-kvm5.15.0-1076.81UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-133.143USN-7288-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-133.143UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-58.60.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1072.73UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1072.73USN-7289-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1026.29UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1026.29~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1026.29.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1033.33UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1021.21UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1026.26UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oracle5.15.0-1075.81USN-7289-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1075.81UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-oracle6.8.0-1024.25UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1024.25~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-raspi5.15.0-1072.75USN-7305-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1072.75UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-riscv6.8.0-58.60.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50153
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-50153
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1044.48UBUNTU-CVE-2024-50153

Affected products (as reported)

VendorProductVersions
Linux Linux 008b936bbde3e87a611b3828a0d5d2a4f99026a0 – before 8c1e6717f60d31f8af3937c23c4f1498529584e11526d9f10c6184031e42afad0adbdde1213e8ad1 – before 39e02fa90323243187c91bb3e8f2f5f6a9aacfc71526d9f10c6184031e42afad0adbdde1213e8ad1 – before 895ab729425ef9bf3b6d2f8d0853abe64896f3141526d9f10c6184031e42afad0adbdde1213e8ad1 – before b80e9bc85bd9af378e7eac83e15dd129557bbdb61526d9f10c6184031e42afad0adbdde1213e8ad1 – before 14a6a2adb440e4ae97bee73b2360946bd033dadd1526d9f10c6184031e42afad0adbdde1213e8ad1 – before fca6caeb4a61d240f031914413fcc69534f6dc035.10.180 – before 5.10.229
Linux Linux 5.11

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References