CVE-2024-38617 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: kunit/fortify: Fix mismatched kvalloc()/vfree() usage The kv*() family of tests were accidentally freeing with vfree() instead of kvfree(). Use kvfree() instead.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

References

Link	Providers
https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a
https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e
https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d
https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec
https://lore.kernel.org/linux-cve-announce/2024061923-CVE-2024-38617-5530@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-38617
https://www.cve.org/CVERecord?id=CVE-2024-38617

History

Fri, 03 Oct 2025 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-763
CPEs		cpe:2.3:o:linux:linux_kernel::::::::

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-19T13:56:16.763Z

Updated: 2025-05-04T09:15:23.602Z

Reserved: 2024-06-18T19:36:34.944Z

Link: CVE-2024-38617

Vulnrichment

Updated: 2024-08-02T04:12:25.990Z

NVD

Status : Analyzed

Published: 2024-06-19T14:15:21.490

Modified: 2025-10-03T15:54:43.490

Link: CVE-2024-38617

Redhat

Severity : Low

Publid Date: 2024-06-19T00:00:00Z

Links: CVE-2024-38617 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38617", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.944Z", "datePublished": "2024-06-19T13:56:16.763Z", "dateUpdated": "2025-05-04T09:15:23.602Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:15:23.602Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit/fortify: Fix mismatched kvalloc()/vfree() usage\n\nThe kv*() family of tests were accidentally freeing with vfree() instead\nof kvfree(). Use kvfree() instead."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/fortify_kunit.c"], "versions": [{"version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "7880dbf4eafe22a6a41a42e774f1122c814ed02d", "status": "affected", "versionType": "git"}, {"version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "42d21c9727028fe7ee392223ba127484b1b8677e", "status": "affected", "versionType": "git"}, {"version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "03758d5a0932016b6d5f5bfbca580177e6bc937a", "status": "affected", "versionType": "git"}, {"version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "998b18072ceb0613629c256b409f4d299829c7ec", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/fortify_kunit.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d"}, {"url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e"}, {"url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a"}, {"url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec"}], "title": "kunit/fortify: Fix mismatched kvalloc()/vfree() usage", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-24T18:11:00.320461Z", "id": "CVE-2024-38617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T18:11:07.454Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.990Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.990Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-24T18:11:00.320461Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T18:11:04.394Z"}}], "cna": {"title": "kunit/fortify: Fix mismatched kvalloc()/vfree() usage", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "7880dbf4eafe22a6a41a42e774f1122c814ed02d", "versionType": "git"}, {"status": "affected", "version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "42d21c9727028fe7ee392223ba127484b1b8677e", "versionType": "git"}, {"status": "affected", "version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "03758d5a0932016b6d5f5bfbca580177e6bc937a", "versionType": "git"}, {"status": "affected", "version": "9124a26401483bf2b13a99cb4317dce3f677060f", "lessThan": "998b18072ceb0613629c256b409f4d299829c7ec", "versionType": "git"}], "programFiles": ["lib/fortify_kunit.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["lib/fortify_kunit.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d"}, {"url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e"}, {"url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a"}, {"url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit/fortify: Fix mismatched kvalloc()/vfree() usage\n\nThe kv*() family of tests were accidentally freeing with vfree() instead\nof kvfree(). Use kvfree() instead."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:05:44.282Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38617", "state": "PUBLISHED", "dateUpdated": "2024-12-19T09:05:44.282Z", "dateReserved": "2024-06-18T19:36:34.944Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T13:56:16.763Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2", "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011", "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit/fortify: Fix mismatched kvalloc()/vfree() usage\n\nThe kv*() family of tests were accidentally freeing with vfree() instead\nof kvfree(). Use kvfree() instead."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kunit/fortify: corrige el uso no coincidente de kvalloc()/vfree() La familia de pruebas kv*() se liberaba accidentalmente con vfree() en lugar de kvfree(). Utilice kvfree() en su lugar."}], "id": "CVE-2024-38617", "lastModified": "2025-10-03T15:54:43.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-19T14:15:21.490", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-763"}], "source": "nvd@nist.gov", "type": "Primary"}]}