CVE-2024-25739

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25739
create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9
https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/mtd/ubi/vtbl.c?h=v6.6.24&id=d1b505c988b7
https://www.spinics.net/lists/kernel/msg5074816.html Mailing List
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9
https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
https://www.spinics.net/lists/kernel/msg5074816.html Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Mar 2025, 18:15

Type Values Removed Values Added
References
  • () https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/mtd/ubi/vtbl.c?h=v6.6.24&id=d1b505c988b7 -

21 Nov 2024, 09:01

Type Values Removed Values Added
References () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9 - () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9 -
References () https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg - Third Party Advisory () https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://www.spinics.net/lists/kernel/msg5074816.html - Mailing List () https://www.spinics.net/lists/kernel/msg5074816.html - Mailing List

27 Jun 2024, 13:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 23:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

25 Mar 2024, 01:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9 -

26 Feb 2024, 21:13

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-754
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
References () https://www.spinics.net/lists/kernel/msg5074816.html - () https://www.spinics.net/lists/kernel/msg5074816.html - Mailing List
References () https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg - () https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg - Third Party Advisory

12 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-12 03:15

Updated : 2025-03-14 19:15

NVD link : CVE-2024-25739

Mitre link : CVE-2024-25739

CVE.ORG link : CVE-2024-25739

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-754

Improper Check for Unusual or Exceptional Conditions