CVE-2024-47677 Information

Description

In the Linux kernel the following vulnerability has been resolved:

exfat: resolve memory leak from exfat_create_upcase_table()

If exfat_load_upcase_table reaches end and returns -EINVAL allocated memory doesn’t get freed and while exfat_load_default_upcase_table allocates more memory leading to a memory leak.

Here’s link to syzkaller crash report illustrating this issue: https://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

https://git.kernel.org/stable/c/f9835aec49670c46ebe2973032caaa1043b3d4da https://git.kernel.org/stable/c/331ed2c739ce656a67865f6b3ee0a478349d78cb https://git.kernel.org/stable/c/c290fe508eee36df1640c3cb35dc8f89e073c8a8

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

5.5