CVE-2024-56730 net/9p/usbg: fix handling of the failed kzalloc() memory allocation
A missing NULL check after kzalloc in the Linux kernel 9p USB transport driver can cause a null pointer dereference and system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56730?
CVE-2024-56730 is a medium-severity vulnerability in Linux kernel, published on 29 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/9p/usbg: fix handling of the failed kzalloc() memory allocation
On the linux-next, next-20241108 vanilla kernel, the coccinelle tool gave the following error report:
./net/9p/trans_usbg.c:912:5-11: ERROR: allocation function on line 911 returns NULL not ERR_PTR on failure
kzalloc() failure is fixed to handle the NULL return case on the memory exhaustion.
Weakness: CWE-476
Which versions are affected by CVE-2024-56730?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56730?
Apply the vendor's patch.
Is CVE-2024-56730 being exploited?
There is no known exploitation of CVE-2024-56730 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-56730, GHSA-pqw3-898v-hg67, UBUNTU-CVE-2024-56730.