CVE-2024-26824 (GCVE-0-2024-26824)
Vulnerability from cvelistv5
Published
2024-04-17 09:43
Modified
2026-08-05 11:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - Remove bogus SGL free on zero-length error path When a zero-length message is hashed by algif_hash, and an error is triggered, it tries to free an SG list that was never allocated in the first place. Fix this by not freeing the SG list on the zero-length error path.
References
Impacted products
Vendor Product Version
Linux Linux Version: b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4
Version: b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4
Version: b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.533Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26824",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:49:04.153967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:31.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_hash.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c82920359b7c1eddaf72069bcfe0ffddf088cd0",
              "status": "affected",
              "version": "b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4",
              "versionType": "git"
            },
            {
              "lessThan": "775f3c1882a493168e08fdb8cde0865c8f3a8a29",
              "status": "affected",
              "version": "b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4",
              "versionType": "git"
            },
            {
              "lessThan": "24c890dd712f6345e382256cae8c97abb0406b70",
              "status": "affected",
              "version": "b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_hash.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_hash - Remove bogus SGL free on zero-length error path\n\nWhen a zero-length message is hashed by algif_hash, and an error\nis triggered, it tries to free an SG list that was never allocated\nin the first place.  Fix this by not freeing the SG list on the\nzero-length error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local syscalls on an AF_ALG socket (socket/bind/accept/sendmsg); there is no network-facing path to this code.\nAC:L - The error path is reliably forced by exhausting the socket\u0027s optmem so hash_alloc_result\u0027s sock_kmalloc fails, and the uninitialized sgt.sgl can be heap-groomed to a controlled non-NULL value; no race or condition outside attacker control is needed.\nPR:L - AF_ALG socket creation and bind perform no capability check, so any unprivileged local user can allocate a hash socket, mark it MSG_MORE, and accept() a child with uninitialized SGL.\nUI:N - The entire trigger sequence is performed by the attacker\u0027s own syscalls; no victim action is required.\nS:U - The corruption stays within the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Freeing an attacker-groomable uninitialized pointer and unpinning arbitrary pages yields heap corruption/UAF that can be leveraged to disclose kernel memory contents.\nI:H - The bogus free of a controllable pointer is an arbitrary-free primitive enabling heap manipulation and subsequent arbitrary write via UAF, allowing kernel state modification.\nA:H - Freeing/dereferencing an invalid or uninitialized pointer readily causes a kernel oops or panic, denying service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:39.564Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29"
        },
        {
          "url": "https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70"
        }
      ],
      "title": "crypto: algif_hash - Remove bogus SGL free on zero-length error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26824",
    "datePublished": "2024-04-17T09:43:50.485Z",
    "dateReserved": "2024-02-19T14:20:24.181Z",
    "dateUpdated": "2026-08-05T11:27:39.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.533Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26824\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:49:04.153967Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.132Z\"}}], \"cna\": {\"title\": \"crypto: algif_hash - Remove bogus SGL free on zero-length error path\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached only through local syscalls on an AF_ALG socket (socket/bind/accept/sendmsg); there is no network-facing path to this code.\\nAC:L - The error path is reliably forced by exhausting the socket\u0027s optmem so hash_alloc_result\u0027s sock_kmalloc fails, and the uninitialized sgt.sgl can be heap-groomed to a controlled non-NULL value; no race or condition outside attacker control is needed.\\nPR:L - AF_ALG socket creation and bind perform no capability check, so any unprivileged local user can allocate a hash socket, mark it MSG_MORE, and accept() a child with uninitialized SGL.\\nUI:N - The entire trigger sequence is performed by the attacker\u0027s own syscalls; no victim action is required.\\nS:U - The corruption stays within the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - Freeing an attacker-groomable uninitialized pointer and unpinning arbitrary pages yields heap corruption/UAF that can be leveraged to disclose kernel memory contents.\\nI:H - The bogus free of a controllable pointer is an arbitrary-free primitive enabling heap manipulation and subsequent arbitrary write via UAF, allowing kernel state modification.\\nA:H - Freeing/dereferencing an invalid or uninitialized pointer readily causes a kernel oops or panic, denying service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4\", \"lessThan\": \"9c82920359b7c1eddaf72069bcfe0ffddf088cd0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4\", \"lessThan\": \"775f3c1882a493168e08fdb8cde0865c8f3a8a29\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4\", \"lessThan\": \"24c890dd712f6345e382256cae8c97abb0406b70\", \"versionType\": \"git\"}], \"programFiles\": [\"crypto/algif_hash.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"crypto/algif_hash.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0\"}, {\"url\": \"https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29\"}, {\"url\": \"https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: algif_hash - Remove bogus SGL free on zero-length error path\\n\\nWhen a zero-length message is hashed by algif_hash, and an error\\nis triggered, it tries to free an SG list that was never allocated\\nin the first place.  Fix this by not freeing the SG list on the\\nzero-length error path.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:39.564Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26824\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:39.564Z\", \"dateReserved\": \"2024-02-19T14:20:24.181Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T09:43:50.485Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.