Log in Start free

Vulnerability · Published Nov 19, 2024 · Assigned by Linux

CVE-2024-50277dm: fix a crash if blk_alloc_disk fails

Medium 4.7

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.2%top 91.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: dm: fix a crash if blk_alloc_disk fails If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt to access it, causing a crash on this statement "md->disk->private_data = NULL;".

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.11.9-1DEBIAN-CVE-2024-50277
Debian:14linux6.11.9-1DEBIAN-CVE-2024-50277
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50277
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50277
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50277

Affected products (as reported)

VendorProductVersions
Linux Linux 74fa8f9c553f7b5ccab7d103acae63cc2e080465 – before d7aec2a06730b774a97caaf48cbbc58330a8582974fa8f9c553f7b5ccab7d103acae63cc2e080465 – before fed13a5478680614ba97fc87e71f16e2e197912e
Linux Linux 6.9

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References