{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-41087", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.634Z", "datePublished": "2024-07-29T15:48:03.127Z", "dateUpdated": "2026-08-05T11:35:17.525Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:17.525Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: Fix double free on error\n\nIf e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump\nto the err_out label, which will call devres_release_group().\ndevres_release_group() will trigger a call to ata_host_release().\nata_host_release() calls kfree(host), so executing the kfree(host) in\nata_host_alloc() will lead to a double free:\n\nkernel BUG at mm/slub.c:553!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 11 PID: 599 Comm: (udev-worker) Not tainted 6.10.0-rc5 #47\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:kfree+0x2cf/0x2f0\nCode: 5d 41 5e 41 5f 5d e9 80 d6 ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da\nRSP: 0018:ffffc90000f377f0 EFLAGS: 00010246\nRAX: ffff888112b1f2c0 RBX: ffff888112b1f2c0 RCX: ffff888112b1f320\nRDX: 000000000000400b RSI: ffffffffc02c9de5 RDI: ffff888112b1f2c0\nRBP: ffffc90000f37830 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffc90000f37610 R11: 617461203a736b6e R12: ffffea00044ac780\nR13: ffff888100046400 R14: ffffffffc02c9de5 R15: 0000000000000006\nFS: 00007f2f1cabe980(0000) GS:ffff88813b380000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f2f1c3acf75 CR3: 0000000111724000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \n ? __die_body.cold+0x19/0x27\n ? die+0x2e/0x50\n ? do_trap+0xca/0x110\n ? do_error_trap+0x6a/0x90\n ? kfree+0x2cf/0x2f0\n ? exc_invalid_op+0x50/0x70\n ? kfree+0x2cf/0x2f0\n ? asm_exc_invalid_op+0x1a/0x20\n ? ata_host_alloc+0xf5/0x120 [libata]\n ? ata_host_alloc+0xf5/0x120 [libata]\n ? kfree+0x2cf/0x2f0\n ata_host_alloc+0xf5/0x120 [libata]\n ata_host_alloc_pinfo+0x14/0xa0 [libata]\n ahci_init_one+0x6c9/0xd20 [ahci]\n\nEnsure that we will not call kfree(host) twice, by performing the kfree()\nonly if the devres_open_group() call failed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - `ata_host_alloc()` is only reachable from libata low-level driver probe routines (`ahci_init_one`, `libahci_platform`, `pata_*`, `ata_pci_sff_init_host`), which run from local device enumeration, module load, or sysfs driver bind. No remote peer or network protocol data ever reaches this code, so local access to the system is required.\nAC:L - The double free is a deterministic code-path defect — once `ata_port_alloc()` returns NULL, `devres_release_group()`'s `ata_devres_release()` → `ata_host_release()` → `kfree(host)` and the fall-through `kfree(host)` always both execute, with no race or memory-layout requirement. The enabling allocation failure targets a large (~13 KB, order-2) `GFP_KERNEL` slab allocation, which an attacker can influence through sustained memory exhaustion and retry indefinitely across repeated probe/hotplug/bind attempts.\nPR:L - The attacker's own contribution — driving the system into the memory-pressure state that makes the probe-time `kzalloc()` fail — requires only ordinary unprivileged local execution, while the probe itself is initiated by routine system activity (boot, udev worker, device hotplug) rather than by any privilege the attacker must hold.\nUI:N - ATA host controller probes are performed automatically by the kernel and udev during enumeration, hotplug, and module load; no administrator or victim action is needed for the vulnerable path to execute.\nS:U - The corruption is confined to the kernel slab allocator of the same host, producing a conventional local kernel compromise or panic. No VM, hypervisor, or IOMMU boundary is crossed.\nC:H - A double free of a `kmalloc`'d object poisons the SLUB freelist so that two independent allocations return the same memory, overlapping `struct ata_host` with an arbitrary other kernel object and giving the attacker a read view into structures they should not see. This is a memory-corruption primitive that can be leveraged for kernel information disclosure.\nI:H - The same freelist-aliasing/type-confusion condition yields a write primitive: one object's writes land inside another live kernel allocation, enabling corruption of function pointers or credential structures and control-flow hijacking. Double frees are a well-established route to kernel privilege escalation.\nA:H - On kernels with `CONFIG_SLAB_FREELIST_HARDENED`/SLUB debugging — the distro default — the second `kfree()` trips `kernel BUG at mm/slub.c:553`, producing the `Oops: invalid opcode` and kernel panic reproduced in the commit message. Even without detection, the aliased slab objects readily corrupt unrelated kernel state and crash the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/ata/libata-core.c" ], "versions": [ { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "290073b2b557e4dc21ee74a1e403d9ae79e393a2", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "56f1c7e290cd6c69c948fcd2e2a49e6a637ec38f", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "010de9acbea58fbcbda08e3793d6262086a493fe", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "5dde5f8b790274723640d29a07c5a97d57d62047", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "702c1edbafb2e6f9d20f6d391273b5be09d366a5", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "062e256516d7db5e7dcdef117f52025cd5c456e3", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "8106da4d88bbaed809e023cc8014b766223d6e76", "status": "affected", "versionType": "git" }, { "version": "dafd6c496381c1cd1f5ba9ad953e810bdcc931bc", "lessThan": "ab9e0c529eb7cafebdd31fe1644524e80a48b05d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/ata/libata-core.c" ], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.317", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.279", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.221", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.162", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.97", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.37", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.8", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "4.19.317" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.4.279" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.221" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.162" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.37" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.9.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/290073b2b557e4dc21ee74a1e403d9ae79e393a2" }, { "url": "https://git.kernel.org/stable/c/56f1c7e290cd6c69c948fcd2e2a49e6a637ec38f" }, { "url": "https://git.kernel.org/stable/c/010de9acbea58fbcbda08e3793d6262086a493fe" }, { "url": "https://git.kernel.org/stable/c/5dde5f8b790274723640d29a07c5a97d57d62047" }, { "url": "https://git.kernel.org/stable/c/702c1edbafb2e6f9d20f6d391273b5be09d366a5" }, { "url": "https://git.kernel.org/stable/c/062e256516d7db5e7dcdef117f52025cd5c456e3" }, { "url": "https://git.kernel.org/stable/c/8106da4d88bbaed809e023cc8014b766223d6e76" }, { "url": "https://git.kernel.org/stable/c/ab9e0c529eb7cafebdd31fe1644524e80a48b05d" } ], "title": "ata: libata-core: Fix double free on error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/290073b2b557e4dc21ee74a1e403d9ae79e393a2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/56f1c7e290cd6c69c948fcd2e2a49e6a637ec38f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/010de9acbea58fbcbda08e3793d6262086a493fe", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5dde5f8b790274723640d29a07c5a97d57d62047", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/702c1edbafb2e6f9d20f6d391273b5be09d366a5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/062e256516d7db5e7dcdef117f52025cd5c456e3", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8106da4d88bbaed809e023cc8014b766223d6e76", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ab9e0c529eb7cafebdd31fe1644524e80a48b05d", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:00:41.841Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-41087", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:20:45.691103Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:58.682Z" } } ] } }