CVE-2024-45028

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: mmc_test: Fix NULL dereference on allocation failure

If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Linux	Linux	>= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < e97be13a9f51284da450dd2a592e3fa87b49cdc9; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < 2b507b03991f44dfb202fc2a82c9874d1b1f0c06; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < 9b9ba386d7bfdbc38445932c90fa9444c0524bea; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < e40515582141a9e7c84b269be699c05236a499a6; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < 3b4e76ceae5b5a46c968bd952f551ce173809f63; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < cac2815f49d343b2f0acc4973d2c14918ac3ab0c; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < ecb15b8ca12c0cbdab81e307e9795214d8b90890; >= 2661081f5ab9cb25359d27f88707a018cf4e68e9, < a1e627af32ed60713941cbfc8075d44cad07f6dd
Linux	Linux	2.6.27

References

Timeline

Published: Sep 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-450295.5In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: Do not mark ACPI devices as irq safe On ACPI machines, the CVE-2024-45037.2A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Affected by this vulnerability is an unknown functionality CVE-2024-450305.5In the Linux kernel, the following vulnerability has been resolved: igb: cope with large MAX_SKB_FRAGS Sabrina reports that the igb driver CVE-2024-450316.1When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject CVE-2024-4503210.0A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versi CVE-2024-450338.1Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2.CVE-2024-450348.8Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it execut CVE-2024-450364.3Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in CVE-2024-450376.4The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create the CVE-2024-450387.5Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on CVE-2024-450396.2gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case CVE-2024-45047.2A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown fu