{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-50055","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-10-21T19:36:19.938Z","datePublished":"2024-10-21T19:39:46.476Z","dateUpdated":"2026-08-05T11:41:17.222Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:41:17.222Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: bus: Fix double free in driver API bus_register()\n\nFor bus_register(), any error which happens after kset_register() will\ncause that @priv are freed twice, fixed by setting @priv with NULL after\nthe first free."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - `bus_register()` is a driver-core API invoked only from subsystem initialization running on the local machine; the unprivileged trigger is a local `socket(AF_NETLINK, SOCK_RAW, NETLINK_ISCSI)` syscall that forces module autoload. No remote peer, network packet, or physical device is involved.\nAC:L - The attacker can drive the system into memory pressure and then repeatedly force `scsi_transport_iscsi` autoload, because a failed module init leaves the netlink protocol unregistered so the request_module can be replayed without limit until an allocation inside `bus_register()` fails. Nothing about the trigger depends on state outside the attacker's influence, and the two `kfree()` calls then execute back-to-back deterministically.\nPR:L - `netlink_create()` performs `request_module(\"net-pf-16-proto-8\")` with no capability check at all, so an ordinary unprivileged user reaches `iscsi_transport_init()` → `bus_register(&iscsi_flashnode_bus)` with a single socket() call. No CAP_SYS_MODULE, no root, and no user-namespace trickery is needed for this path.\nUI:N - The attacker performs every step itself — create memory pressure, issue the socket() call that triggers autoload — with no victim action, mount, file open, or administrator involvement required.\nS:U - The corrupted object is a kernel slab allocation and the consequences stay entirely within the kernel's own security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The double free makes the SLUB freelist self-referential so two later allocations of the same size class alias one address, giving type confusion between attacker-controlled and kernel objects and thus an arbitrary kernel-memory read primitive. Freed-object contents can be reclaimed and disclosed through the aliased structure.\nI:H - The same freelist aliasing lets an attacker-sprayed object overwrite the fields of an unrelated live kernel structure — including function pointers reachable from `struct subsys_private`-sized kmalloc objects — yielding an arbitrary write and control-flow hijack primitive, i.e. full local privilege escalation.\nA:H - Even without successful exploitation the double free corrupts the slab allocator and panics the machine; on kernels built with CONFIG_SLAB_FREELIST_HARDENED the `BUG_ON(object == fp)` in `set_freepointer()` fires immediately, and `bus_release()` additionally calls `lockdep_unregister_key()` on a never-registered key on the early error paths."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/base/bus.c"],"versions":[{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","lessThan":"d885c464c25018b81a6b58f5d548fc2e3ef87dd1","status":"affected","versionType":"git"},{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","lessThan":"9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a","status":"affected","versionType":"git"},{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","lessThan":"bfa54a793ba77ef696755b66f3ac4ed00c7d1248","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/base/bus.c"],"versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","status":"unaffected","versionType":"semver"},{"version":"6.6.57","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.11.4","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.11.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d885c464c25018b81a6b58f5d548fc2e3ef87dd1"},{"url":"https://git.kernel.org/stable/c/9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a"},{"url":"https://git.kernel.org/stable/c/bfa54a793ba77ef696755b66f3ac4ed00c7d1248"}],"title":"driver core: bus: Fix double free in driver API bus_register()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-50055","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-22T13:23:36.877414Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-22T13:28:43.087Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:43:22.001Z"}}]}}