Vulnerability · Published Jan 6, 2025 · Assigned by Linux
CVE-2024-56766mtd: rawnand: fix double free in atmel_pmecc_create_user()
High 7.8
In plain English
A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 87.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 6.1.123-1 | DEBIAN-CVE-2024-56766 |
| Debian:13 | linux | 6.12.8-1 | DEBIAN-CVE-2024-56766 |
| Debian:14 | linux | 6.12.8-1 | DEBIAN-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:24.04:LTS | linux-hwe-6.11 | 6.11.0-21.21~24.04.1 | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:24.04:LTS | linux-oem-6.11 | 6.11.0-1017.17 | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2024-56766 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | no fix listed | UBUNTU-CVE-2024-56766 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 22fbbc37edb840fd420fadf670366be9bf028426 – before ca9818554b0f33e87f38e4bfa2dac056692d46cc54cb5fa850f9306d84e49a3db44b7a7eb5536cd1 – before 1562871ef613fa9492aa0310933eff785166a90e5fe7709251e334cc27618473299c48340cecd3c8 – before 3d825a241e65f7e3072978729e79d735ec40b80e24cbc37e837fd9e31e5024480b779207d1d99f1d – before 6ea15205d7e2b811fbbdf79783f686f58abfb4b7f1290871c8aaeb13029390a2b6e5c05733a1be6f – before dd45c87782738715d5e7c167f8dabf0814a7394a8ac19ec818c548c5788da5926dcc8af96fad4bb1 – before d2f090ea57f8d6587e09d4066f740a8617767b3d6d734f1bfc336aaea91313a5632f2f197608fadd – before d8e4771f99c0400a1873235704b28bb803c83d172014fcea19ec27df033359a0f42db0e8ed4290a8 |
| Linux | Linux | 5.4.287 – before 5.4.2895.10.231 – before 5.10.2335.15.174 – before 5.15.1766.1.120 – before 6.1.1236.6.64 – before 6.6.696.12.2 – before 6.12.8 |
References
- https://git.kernel.org/stable/c/ca9818554b0f33e87f38e4bfa2dac056692d46cc
- https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e
- https://git.kernel.org/stable/c/3d825a241e65f7e3072978729e79d735ec40b80e
- https://git.kernel.org/stable/c/6ea15205d7e2b811fbbdf79783f686f58abfb4b7
- https://git.kernel.org/stable/c/dd45c87782738715d5e7c167f8dabf0814a7394a
- https://git.kernel.org/stable/c/d2f090ea57f8d6587e09d4066f740a8617767b3d
- https://git.kernel.org/stable/c/d8e4771f99c0400a1873235704b28bb803c83d17
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html