CVE-2024-33619

MediumCVSS 5.5/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

efi: libstub: only free priv.runtime_map when allocated

priv.runtime_map is only allocated when efi_novamap is not set. Otherwise, it is an uninitialized value. In the error path, it is freed unconditionally. Avoid passing an uninitialized value to free_pool. Free priv.runtime_map only when it was allocated.

This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
Linux	Linux	>= f80d26043af91ceb5036c478101c015edb9e7630, < b8938d6f570f010a1dcdbfed3e5b5d3258c2a908; >= f80d26043af91ceb5036c478101c015edb9e7630, < 9dce01f386c9ce6990c0a83fa14b1c95330b037e; >= f80d26043af91ceb5036c478101c015edb9e7630, < 6ca67a5fe1c606d1fbe24c30a9fc0bdc43a18554; >= f80d26043af91ceb5036c478101c015edb9e7630, < 4b2543f7e1e6b91cfc8dd1696e3cdf01c3ac8974
Linux	Linux	6.1

References

https://git.kernel.org/stable/c/4b2543f7e1e6b91cfc8dd1696e3cdf01c3ac8974Mailing List, Patch
https://git.kernel.org/stable/c/6ca67a5fe1c606d1fbe24c30a9fc0bdc43a18554Mailing List, Patch
https://git.kernel.org/stable/c/9dce01f386c9ce6990c0a83fa14b1c95330b037eMailing List, Patch
https://git.kernel.org/stable/c/b8938d6f570f010a1dcdbfed3e5b5d3258c2a908Mailing List, Patch
https://git.kernel.org/stable/c/4b2543f7e1e6b91cfc8dd1696e3cdf01c3ac8974Mailing List, Patch
https://git.kernel.org/stable/c/6ca67a5fe1c606d1fbe24c30a9fc0bdc43a18554Mailing List, Patch
https://git.kernel.org/stable/c/9dce01f386c9ce6990c0a83fa14b1c95330b037eMailing List, Patch
https://git.kernel.org/stable/c/b8938d6f570f010a1dcdbfed3e5b5d3258c2a908Mailing List, Patch

Timeline

Published: Jun 21, 2024
Last modified: Aug 4, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-33628.8A vulnerability was found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this issue is some unknown fun CVE-2024-336208.6Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the f CVE-2024-336215.5In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet CVE-2024-336226.5Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerabilit CVE-2024-336237.5A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request CVE-2024-336244.3Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated user CVE-2024-336259.8CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens CVE-2024-336265.3The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive informa CVE-2024-336274.4Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom CVE-2024-336288.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclus CVE-2024-336294.4Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featur CVE-2024-33639.8A vulnerability was found in SourceCodester Online Library System 1.0. It has been classified as critical. This affects an unknown part of t