CVE-2024-50027 (GCVE-0-2024-50027)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-08-05 11:41
VLAI
Title
thermal: core: Free tzp copy along with the thermal zone
Summary
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Free tzp copy along with the thermal zone The object pointed to by tz->tzp may still be accessed after being freed in thermal_zone_device_unregister(), so move the freeing of it to the point after the removal completion has been completed at which it cannot be accessed any more.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:26 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3d439b1a2ad36c8b4ea151c8de25309d60d17407 , < eabe285e1c629a719d6e68fc319939c63b83bf22 (git)
Affected: 3d439b1a2ad36c8b4ea151c8de25309d60d17407 , < bdb0d40507c85bee33c2a71fde7b2e857346f112 (git)
Affected: 3d439b1a2ad36c8b4ea151c8de25309d60d17407 , < 827a07525c099f54d3b15110408824541ec66b3c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.60 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:26:36.583525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:46.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eabe285e1c629a719d6e68fc319939c63b83bf22",
              "status": "affected",
              "version": "3d439b1a2ad36c8b4ea151c8de25309d60d17407",
              "versionType": "git"
            },
            {
              "lessThan": "bdb0d40507c85bee33c2a71fde7b2e857346f112",
              "status": "affected",
              "version": "3d439b1a2ad36c8b4ea151c8de25309d60d17407",
              "versionType": "git"
            },
            {
              "lessThan": "827a07525c099f54d3b15110408824541ec66b3c",
              "status": "affected",
              "version": "3d439b1a2ad36c8b4ea151c8de25309d60d17407",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.60",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Free tzp copy along with the thermal zone\n\nThe object pointed to by tz-\u003etzp may still be accessed after being\nfreed in thermal_zone_device_unregister(), so move the freeing of it\nto the point after the removal completion has been completed at which\nit cannot be accessed any more."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling `tz-\u003etzp` is reached through the thermal generic-netlink family (AF_NETLINK socket, init netns) and the world-readable `/sys/class/thermal/thermal_zoneN/{slope,offset,k_*,sustainable_powe r}` attributes, and the free side is a local device/driver teardown; no remote peer parses any of this data.\nAC:L - The attacker drives the surviving side of the race itself \u2014 a tight loop of `THERMAL_GENL_CMD_TZ_GET_TEMP`/`TZ_GET_TRIP` pins the zone with `get_device()` while unregistration proceeds \u2014 and the freed window spans `device_del()` teardown, a netlink multicast delete notification and an unbounded `wait_for_completion()`, which is wide enough to reliably reclaim the 48-byte `tzp` from the heavily-trafficked kmalloc-64 cache; the attempt is repeatable at will.\nPR:L - None of the thermal genl ops set `GENL_ADMIN_PERM` (`thermal_genl_ops[]`), and `thermal_zone_get_by_id()` performs no capability check, so an ordinary unprivileged local user obtains and holds the zone reference; the `tzp` sysfs show handlers are likewise world-readable at 0444/0644.\nUI:N - The attacker\u0027s netlink polling loop needs no cooperation from any other user, and the unregistration it races is ordinary system activity (charger/battery power-supply removal, transceiver or CPU-package zone teardown, driver rebind) rather than an action the attacker must induce a victim to perform.\nS:U - The corrupted memory is kernel slab memory managed by the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `thermal_zone_get_slope()`/`thermal_zone_get_offset()` and the power-allocator PID code read the freed `tzp`, and those values propagate into the temperature returned over netlink and sysfs, disclosing whatever kernel object has since been allocated into the reclaimed kmalloc-64 slot; as with any UAF the stale pointer generalises into an arbitrary-read primitive once the attacker controls the reallocation.\nI:H - The dangling pointer is also written through \u2014 `estimate_pid_constants()`/`get_sustainable_power()` store into `tz-\u003etzp-\u003ek_po`, `k_pu`, `k_i` and `sustainable_power`, and the `sustainable_power`/`k_*`/`slope`/`offset` sysfs store handlers assign directly through `tz-\u003etzp` \u2014 giving a heap write into a reallocated, groomable kmalloc-64 object and thus corruption of adjacent kernel structures usable for control-flow hijack and privilege escalation.\nA:H - Dereferencing the freed `tzp` (plus the `def_governor` fallback entering `power_allocator_manage()` with `tz-\u003egovernor_data` already NULLed) produces slab use-after-free corruption and oops/panic, and an unprivileged user can retry the race indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:03.310Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eabe285e1c629a719d6e68fc319939c63b83bf22"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdb0d40507c85bee33c2a71fde7b2e857346f112"
        },
        {
          "url": "https://git.kernel.org/stable/c/827a07525c099f54d3b15110408824541ec66b3c"
        }
      ],
      "title": "thermal: core: Free tzp copy along with the thermal zone",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50027",
    "datePublished": "2024-10-21T19:39:31.141Z",
    "dateReserved": "2024-10-21T12:17:06.066Z",
    "dateUpdated": "2026-08-05T11:41:03.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50027",
      "date": "2026-09-23",
      "epss": "0.00244",
      "percentile": "0.15913"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A1A39D0B-911D-4BC7-B521-FC88BD5E23EF",
                  "versionEndIncluding": "6.11.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Free tzp copy along with the thermal zone\n\nThe object pointed to by tz-\u003etzp may still be accessed after being\nfreed in thermal_zone_device_unregister(), so move the freeing of it\nto the point after the removal completion has been completed at which\nit cannot be accessed any more."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: thermal: core: copia libre de tzp junto con la zona t\u00e9rmica. A\u00fan se puede acceder al objeto al que apunta tz-\u0026gt;tzp despu\u00e9s de liberarlo en thermal_zone_device_unregister(), por lo que debe mover su liberaci\u00f3n al punto despu\u00e9s de que se haya completado la eliminaci\u00f3n en el que ya no se pueda acceder a \u00e9l."
        }
      ],
      "id": "CVE-2024-50027",
      "lastModified": "2024-11-08T16:15:42.213",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T20:15:16.093",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/827a07525c099f54d3b15110408824541ec66b3c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/bdb0d40507c85bee33c2a71fde7b2e857346f112"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/eabe285e1c629a719d6e68fc319939c63b83bf22"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-03T22:29:21.000Z",
      "cve": "CVE-2024-50027",
      "id": "msrc_CVE-2024-50027",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "thermal: core: Free tzp copy along with the thermal zone",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50027.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thermal/thermal_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "eabe285e1c629a719d6e68fc319939c63b83bf22",
                    "status": "affected",
                    "version": "3d439b1a2ad36c8b4ea151c8de25309d60d17407",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bdb0d40507c85bee33c2a71fde7b2e857346f112",
                    "status": "affected",
                    "version": "3d439b1a2ad36c8b4ea151c8de25309d60d17407",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "827a07525c099f54d3b15110408824541ec66b3c",
                    "status": "affected",
                    "version": "3d439b1a2ad36c8b4ea151c8de25309d60d17407",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thermal/thermal_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.60",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A39D0B-911D-4BC7-B521-FC88BD5E23EF",
                    "versionEndIncluding": "6.11.4",
                    "versionStartIncluding": "6.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Free tzp copy along with the thermal zone\n\nThe object pointed to by tz-\u003etzp may still be accessed after being\nfreed in thermal_zone_device_unregister(), so move the freeing of it\nto the point after the removal completion has been completed at which\nit cannot be accessed any more."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: thermal: core: copia libre de tzp junto con la zona t\u00e9rmica. A\u00fan se puede acceder al objeto al que apunta tz-\u0026gt;tzp despu\u00e9s de liberarlo en thermal_zone_device_unregister(), por lo que debe mover su liberaci\u00f3n al punto despu\u00e9s de que se haya completado la eliminaci\u00f3n en el que ya no se pueda acceder a \u00e9l."
          }
        ],
        "id": "CVE-2024-50027",
        "lastModified": "2026-08-04T11:21:08.637",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-50027",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:26:36.583525Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T20:15:16.093",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/827a07525c099f54d3b15110408824541ec66b3c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bdb0d40507c85bee33c2a71fde7b2e857346f112"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eabe285e1c629a719d6e68fc319939c63b83bf22"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T15:57:20+00:00",
      "cve": "CVE-2024-50027",
      "id": "CVE-2024-50027",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: thermal: core: Free tzp copy along with the thermal zone",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50027.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:57:21Z",
      "cve": "CVE-2024-50027",
      "id": "CVE-2024-50027",
      "initial_release_date": "2024-10-22T02:50:17Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "474",
      "product_status:recommended": "410",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50027",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50027.json",
      "version": "65"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-50027",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-22T13:26:36.583525Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-22T13:26:40.483Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/thermal/thermal_core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "eabe285e1c62",
                  "status": "affected",
                  "version": "3d439b1a2ad3",
                  "versionType": "git"
                },
                {
                  "lessThan": "bdb0d40507c8",
                  "status": "affected",
                  "version": "3d439b1a2ad3",
                  "versionType": "git"
                },
                {
                  "lessThan": "827a07525c09",
                  "status": "affected",
                  "version": "3d439b1a2ad3",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/thermal/thermal_core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.4"
                },
                {
                  "lessThan": "6.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.60",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12-rc3",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Free tzp copy along with the thermal zone\n\nThe object pointed to by tz-\u003etzp may still be accessed after being\nfreed in thermal_zone_device_unregister(), so move the freeing of it\nto the point after the removal completion has been completed at which\nit cannot be accessed any more."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-08T15:57:58.861Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/eabe285e1c629a719d6e68fc319939c63b83bf22"
            },
            {
              "url": "https://git.kernel.org/stable/c/bdb0d40507c85bee33c2a71fde7b2e857346f112"
            },
            {
              "url": "https://git.kernel.org/stable/c/827a07525c099f54d3b15110408824541ec66b3c"
            }
          ],
          "title": "thermal: core: Free tzp copy along with the thermal zone",
          "x_generator": {
            "engine": "bippy-9e1c9544281a"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-50027",
        "datePublished": "2024-10-21T19:39:31.141Z",
        "dateReserved": "2024-10-21T12:17:06.066Z",
        "dateUpdated": "2024-11-08T15:57:58.861Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.