CVE-2024-50153

scsi: target: core: Fix null-ptr-deref in target_alloc_device()

MEDIUM

5.5

CVSS Score

Published: November 7, 2024 at 09:31 AM UTC

Updated: October 15, 2026 at 01:19 AM UTC

2 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFP

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.1705.16 ≤ v < 6.1.1156.2 ≤ v < 6.6.596.7 ≤ v < 6.11.61526d9f10c6184031e42afad0adbdde1213e8ad15.10.180 6.12 6.12 rc1 6.12 rc2 6.12 rc38b936bbde3e87a611b3828a0d5d2a4f99026a0

Vendor states this is fixed in 14a6a2adb440e4ae97bee73b2360946bd033dadd (fixed)

Vendor states this is fixed in 39e02fa90323243187c91bb3e8f2f5f6a9aacfc7 (fixed)

Vendor states this is fixed in 895ab729425ef9bf3b6d2f8d0853abe64896f314 (fixed)

Vendor states this is fixed in 8c1e6717f60d31f8af3937c23c4f1498529584e1 (fixed)

Vendor states this is fixed in b80e9bc85bd9af378e7eac83e15dd129557bbdb6 (fixed)

Vendor states this is fixed in fca6caeb4a61d240f031914413fcc69534f6dc03 (fixed)

Vendor states this is fixed in 5.10.229 (unaffected)

Vendor states this is fixed in 5.11 (unaffected)

Vendor states this is fixed in 5.15.170 (unaffected)

Vendor states this is fixed in 6.1.115 (unaffected)

Vendor states this is fixed in 6.11.6 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)