CVE-2024-33619 efi: libstub: only free priv.runtime_map when allocated
An attacker can cause a denial of service in the Linux kernel by triggering an error path that frees uninitialized memory in the EFI stub.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33619?
CVE-2024-33619 is a high-severity vulnerability in Linux kernel, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
efi: libstub: only free priv.runtime_map when allocated
priv.runtime_map is only allocated when efi_novamap is not set. Otherwise, it is an uninitialized value. In the error path, it is freed unconditionally. Avoid passing an uninitialized value to free_pool. Free priv.runtime_map only when it was allocated.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
Weakness: CWE-908
Which versions are affected by CVE-2024-33619?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-33619?
Apply the vendor's patch.
Is CVE-2024-33619 being exploited?
There is no known exploitation of CVE-2024-33619 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-33619, DEBIAN-CVE-2024-33619, GHSA-9m7h-hjwm-6r7m, UBUNTU-CVE-2024-33619.