CVE-2024-46673 (GCVE-0-2024-46673)

Vulnerability from cvelistv5 – Published: 2024-09-13 05:29 – Updated: 2026-08-05 11:37
VLAI
Title
scsi: aacraid: Fix double-free on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 15:45 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < d237c7d06ffddcdb5d36948c527dc01284388218 (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 564e1986b00c5f05d75342f8407f75f0a17b94df (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 85449b28ff6a89c4513115e43ddcad949b5890c9 (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 60962c3d8e18e5d8dfa16df788974dd7f35bd87a (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 8a3995a3ffeca280a961b59f5c99843d81b15929 (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 4b540ec7c0045c2d01c4e479f34bbc8f147afa4c (git)
Affected: 8e0c5ebde82b08f6d996e11983890fc4cc085fab , < 919ddf8336f0b84c0453bac583808c9f165a85c2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.15
Unaffected: 0 , < 2.6.15 (semver)
Unaffected: 4.19.321 , ≤ 4.19.* (semver)
Unaffected: 5.4.283 , ≤ 5.4.* (semver)
Unaffected: 5.10.225 , ≤ 5.10.* (semver)
Unaffected: 5.15.166 , ≤ 5.15.* (semver)
Unaffected: 6.1.108 , ≤ 6.1.* (semver)
Unaffected: 6.6.49 , ≤ 6.6.* (semver)
Unaffected: 6.10.8 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:45:02.828351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:45:17.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:05.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/aacraid/comminit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d237c7d06ffddcdb5d36948c527dc01284388218",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "564e1986b00c5f05d75342f8407f75f0a17b94df",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "9e96dea7eff6f2bbcd0b42a098012fc66af9eb69",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "85449b28ff6a89c4513115e43ddcad949b5890c9",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "60962c3d8e18e5d8dfa16df788974dd7f35bd87a",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "8a3995a3ffeca280a961b59f5c99843d81b15929",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "4b540ec7c0045c2d01c4e479f34bbc8f147afa4c",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            },
            {
              "lessThan": "919ddf8336f0b84c0453bac583808c9f165a85c2",
              "status": "affected",
              "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/aacraid/comminit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.321",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.321",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.283",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.225",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.108",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.49",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aacraid: Fix double-free on probe failure\n\naac_probe_one() calls hardware-specific init functions through the\naac_driver_ident::init pointer, all of which eventually call down to\naac_init_adapter().\n\nIf aac_init_adapter() fails after allocating memory for aac_dev::queues,\nit frees the memory but does not clear that member.\n\nAfter the hardware-specific init function returns an error,\naac_probe_one() goes down an error path that frees the memory pointed to\nby aac_dev::queues, resulting.in a double-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a PCI probe/adapter-reset path for a local Adaptec RAID HBA, reached only from local driver bind, the `/dev/aacN` ioctl, sysfs `reset_host`, or SCSI error handling. No remote or adjacent-network input reaches it.\nAC:L - Triggering requires the adapter re-init to hit an allocation failure at `aac_comm_init()`/`aac_fib_setup()` while a probe or host-reset is in flight; an attacker able to invoke the reset path can loop it while driving DMA32 memory pressure, controlling both sides and retrying until the ENOMEM window lands.\nPR:L - Once `dev-\u003equeues` is left dangling, any local user can drive the paths that dereference and re-free it (ioctl handling, I/O to the array); a plain unprivileged local account is sufficient to supply the memory pressure and to reuse the freed slab object.\nUI:N - No victim action is needed \u2014 the free and the subsequent reuse/second free happen inside the driver\u0027s own error unwind and interrupt/kthread contexts.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `dev-\u003equeues` is read by the interrupt handlers, the command kthread, and the ioctl path after the object is freed, and the double free lets an attacker place a controlled object at that address \u2014 yielding disclosure of arbitrary reallocated kernel data.\nI:H - Freed memory is written through the dangling pointer (queue head/tail indices, list_head links, atomics) and the double free hands the attacker the classic two-owners-of-one-slab-object primitive, which is escalatable to arbitrary kernel write and control-flow hijack.\nA:H - A `kfree()` of an already-freed pointer trips SLUB freelist-hardening `BUG()` or corrupts the freelist, and the dangling `dev-\u003equeues` dereference from interrupt context reliably oopses \u2014 a full kernel panic on the storage controller."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:52.370Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d237c7d06ffddcdb5d36948c527dc01284388218"
        },
        {
          "url": "https://git.kernel.org/stable/c/564e1986b00c5f05d75342f8407f75f0a17b94df"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e96dea7eff6f2bbcd0b42a098012fc66af9eb69"
        },
        {
          "url": "https://git.kernel.org/stable/c/85449b28ff6a89c4513115e43ddcad949b5890c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/60962c3d8e18e5d8dfa16df788974dd7f35bd87a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a3995a3ffeca280a961b59f5c99843d81b15929"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b540ec7c0045c2d01c4e479f34bbc8f147afa4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/919ddf8336f0b84c0453bac583808c9f165a85c2"
        }
      ],
      "title": "scsi: aacraid: Fix double-free on probe failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46673",
    "datePublished": "2024-09-13T05:29:09.649Z",
    "dateReserved": "2024-09-11T15:12:18.247Z",
    "dateUpdated": "2026-08-05T11:37:52.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46673",
      "date": "2026-10-07",
      "epss": "0.00295",
      "percentile": "0.20292"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:41:12.000Z",
      "cve": "CVE-2024-46673",
      "id": "msrc_CVE-2024-46673",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: aacraid: Fix double-free on probe failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46673.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/aacraid/comminit.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d237c7d06ffddcdb5d36948c527dc01284388218",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "564e1986b00c5f05d75342f8407f75f0a17b94df",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e96dea7eff6f2bbcd0b42a098012fc66af9eb69",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85449b28ff6a89c4513115e43ddcad949b5890c9",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60962c3d8e18e5d8dfa16df788974dd7f35bd87a",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a3995a3ffeca280a961b59f5c99843d81b15929",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4b540ec7c0045c2d01c4e479f34bbc8f147afa4c",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "919ddf8336f0b84c0453bac583808c9f165a85c2",
                    "status": "affected",
                    "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/aacraid/comminit.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.15"
                  },
                  {
                    "lessThan": "2.6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.321",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.283",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.225",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.166",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.108",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.49",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A6F6D3-6AE5-49E8-93CC-51BA81989E5D",
                    "versionEndExcluding": "4.19.321",
                    "versionStartIncluding": "2.6.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E6B390A-0CE6-44FC-8CD5-BE8226D6D24C",
                    "versionEndExcluding": "5.4.283",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C57B46A9-B105-4792-8481-1870DEFB436A",
                    "versionEndExcluding": "5.10.225",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "913ED6CD-8ACF-48AF-AA18-7880881DD402",
                    "versionEndExcluding": "5.15.166",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B5BE381-F079-43D9-AEF2-931856B13219",
                    "versionEndExcluding": "6.1.108",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1191B7F1-F275-45F5-9E82-A012FF517BFA",
                    "versionEndExcluding": "6.6.49",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1B5D46C3-56A4-4380-9309-27BF73DF29A7",
                    "versionEndExcluding": "6.10.8",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aacraid: Fix double-free on probe failure\n\naac_probe_one() calls hardware-specific init functions through the\naac_driver_ident::init pointer, all of which eventually call down to\naac_init_adapter().\n\nIf aac_init_adapter() fails after allocating memory for aac_dev::queues,\nit frees the memory but does not clear that member.\n\nAfter the hardware-specific init function returns an error,\naac_probe_one() goes down an error path that frees the memory pointed to\nby aac_dev::queues, resulting.in a double-free."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: aacraid: Fix double-free on probe failure aac_probe_one() llama a funciones init espec\u00edficas del hardware a trav\u00e9s del puntero aac_driver_ident::init, todas las cuales eventualmente invocan a aac_init_adapter(). Si aac_init_adapter() falla despu\u00e9s de asignar memoria para aac_dev::queues, libera la memoria pero no borra ese miembro. Despu\u00e9s de que la funci\u00f3n init espec\u00edfica del hardware devuelve un error, aac_probe_one() recorre una ruta de error que libera la memoria a la que apunta aac_dev::queues, lo que da como resultado una doble liberaci\u00f3n."
          }
        ],
        "id": "CVE-2024-46673",
        "lastModified": "2026-08-04T11:20:13.583",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-46673",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:45:02.828351Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-13T06:15:11.917",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4b540ec7c0045c2d01c4e479f34bbc8f147afa4c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/564e1986b00c5f05d75342f8407f75f0a17b94df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/60962c3d8e18e5d8dfa16df788974dd7f35bd87a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/85449b28ff6a89c4513115e43ddcad949b5890c9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8a3995a3ffeca280a961b59f5c99843d81b15929"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/919ddf8336f0b84c0453bac583808c9f165a85c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9e96dea7eff6f2bbcd0b42a098012fc66af9eb69"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d237c7d06ffddcdb5d36948c527dc01284388218"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T18:45:39+00:00",
      "cve": "CVE-2024-46673",
      "id": "CVE-2024-46673",
      "initial_release_date": "2024-09-13T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: aacraid: Fix double-free on probe failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46673.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:16:05.090Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-46673",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-29T15:45:02.828351Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-29T15:45:06.892Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/aacraid/comminit.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "d237c7d06ffddcdb5d36948c527dc01284388218",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "564e1986b00c5f05d75342f8407f75f0a17b94df",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "9e96dea7eff6f2bbcd0b42a098012fc66af9eb69",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "85449b28ff6a89c4513115e43ddcad949b5890c9",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "60962c3d8e18e5d8dfa16df788974dd7f35bd87a",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "8a3995a3ffeca280a961b59f5c99843d81b15929",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "4b540ec7c0045c2d01c4e479f34bbc8f147afa4c",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                },
                {
                  "lessThan": "919ddf8336f0b84c0453bac583808c9f165a85c2",
                  "status": "affected",
                  "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/aacraid/comminit.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.15"
                },
                {
                  "lessThan": "2.6.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.321",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.283",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.225",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.166",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.108",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.49",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.321",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.283",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.225",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.166",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.108",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.49",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.8",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "2.6.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aacraid: Fix double-free on probe failure\n\naac_probe_one() calls hardware-specific init functions through the\naac_driver_ident::init pointer, all of which eventually call down to\naac_init_adapter().\n\nIf aac_init_adapter() fails after allocating memory for aac_dev::queues,\nit frees the memory but does not clear that member.\n\nAfter the hardware-specific init function returns an error,\naac_probe_one() goes down an error path that frees the memory pointed to\nby aac_dev::queues, resulting.in a double-free."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable code is a PCI probe/adapter-reset path for a local Adaptec RAID HBA, reached only from local driver bind, the `/dev/aacN` ioctl, sysfs `reset_host`, or SCSI error handling. No remote or adjacent-network input reaches it.\nAC:L - Triggering requires the adapter re-init to hit an allocation failure at `aac_comm_init()`/`aac_fib_setup()` while a probe or host-reset is in flight; an attacker able to invoke the reset path can loop it while driving DMA32 memory pressure, controlling both sides and retrying until the ENOMEM window lands.\nPR:L - Once `dev-\u003equeues` is left dangling, any local user can drive the paths that dereference and re-free it (ioctl handling, I/O to the array); a plain unprivileged local account is sufficient to supply the memory pressure and to reuse the freed slab object.\nUI:N - No victim action is needed \u2014 the free and the subsequent reuse/second free happen inside the driver\u0027s own error unwind and interrupt/kthread contexts.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `dev-\u003equeues` is read by the interrupt handlers, the command kthread, and the ioctl path after the object is freed, and the double free lets an attacker place a controlled object at that address \u2014 yielding disclosure of arbitrary reallocated kernel data.\nI:H - Freed memory is written through the dangling pointer (queue head/tail indices, list_head links, atomics) and the double free hands the attacker the classic two-owners-of-one-slab-object primitive, which is escalatable to arbitrary kernel write and control-flow hijack.\nA:H - A `kfree()` of an already-freed pointer trips SLUB freelist-hardening `BUG()` or corrupts the freelist, and the dangling `dev-\u003equeues` dereference from interrupt context reliably oopses \u2014 a full kernel panic on the storage controller."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:37:52.370Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/d237c7d06ffddcdb5d36948c527dc01284388218"
            },
            {
              "url": "https://git.kernel.org/stable/c/564e1986b00c5f05d75342f8407f75f0a17b94df"
            },
            {
              "url": "https://git.kernel.org/stable/c/9e96dea7eff6f2bbcd0b42a098012fc66af9eb69"
            },
            {
              "url": "https://git.kernel.org/stable/c/85449b28ff6a89c4513115e43ddcad949b5890c9"
            },
            {
              "url": "https://git.kernel.org/stable/c/60962c3d8e18e5d8dfa16df788974dd7f35bd87a"
            },
            {
              "url": "https://git.kernel.org/stable/c/8a3995a3ffeca280a961b59f5c99843d81b15929"
            },
            {
              "url": "https://git.kernel.org/stable/c/4b540ec7c0045c2d01c4e479f34bbc8f147afa4c"
            },
            {
              "url": "https://git.kernel.org/stable/c/919ddf8336f0b84c0453bac583808c9f165a85c2"
            }
          ],
          "title": "scsi: aacraid: Fix double-free on probe failure",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-46673",
        "datePublished": "2024-09-13T05:29:09.649Z",
        "dateReserved": "2024-09-11T15:12:18.247Z",
        "dateUpdated": "2026-08-05T11:37:52.370Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.