DEBIAN-CVE-2024-50153
Record from OSV · Published November 7, 2024
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux | Debian:12 | 6.1.115-1 |
| linux | Debian:13 | 6.11.6-1 |
| linux | Debian:14 | 6.11.6-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | linux | 6.1.99-1, 0, 6.1.106-1 |
| Debian:13 | linux | 0 |
| Debian:14 | linux | 0 |
Timeline
- Nov 7, 2024 CVE Published
- Oct 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2024-50153
vulnetix vdb fixes DEBIAN-CVE-2024-50153Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2024-50153/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart