vulnerability

Debian: CVE-2024-50088: linux, linux-6.1 -- security update

Severity
7
CVSS
(AV:L/AC:L/Au:S/C:C/I:C/A:C)
Published
Oct 29, 2024
Added
Nov 11, 2024
Modified
Jan 30, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix uninitialized pointer free in add_inode_ref()

The add_inode_ref() function does not initialize the "name" struct when
it is declared. If any of the following calls to "read_one_inode()
returns NULL,

dir = read_one_inode(root, parent_objectid);
if (!dir) {
ret = -ENOENT;
goto out;
}

inode = read_one_inode(root, inode_objectid);
if (!inode) {
ret = -EIO;
goto out;
}

then "name.name" would be freed on "out" before being initialized.

out:
...
kfree(name.name);

This issue was reported by Coverity with CID 1526744.

Solution(s)

debian-upgrade-linuxdebian-upgrade-linux-6-1
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.