Security readout for executives and security teams
Plain-English summary
A Linux EFI boot bug can attempt to release an uninitialized memory pointer during a specific failure path. This may cause serious memory corruption or system impact, although the supplied sources do not document a demonstrated attack or specific real-world outcome.
Executive priority
Handle through an accelerated high-severity kernel patch cycle, especially for EFI fleets exposed to local users or untrusted workloads. Evidence does not support an emergency response for active internet exploitation, but the potential impact and incomplete exploitability evidence justify timely remediation.
Technical view
When efi_novamap is set, priv.runtime_map is not allocated. An EFI libstub error path nevertheless passed that uninitialized field to free_pool. The fix frees it only when allocated. The CVSS vector describes a local, low-complexity, low-privilege attack requiring no user interaction, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Linux systems using affected kernel builds and the EFI libstub are candidates. Reaching the flaw additionally requires the efi_novamap condition and relevant error path. The supplied affected-version metadata is ambiguous, so distribution package and backport status must be checked directly.
Exploitation context
The supplied record is not in KEV, and no cited source reports active exploitation. CVSS indicates local rather than remote access. The sources provide no proof of exploitation, observed attacks, or detailed trigger prerequisites beyond the EFI configuration and error path.
Researcher notes
Coverity SAST identified the issue. The public description explains the uninitialized free and corrective condition but provides no reproducer, exploitation analysis, or distribution-package mapping. Four stable-kernel commits are supplied. Assess each build using source or vendor backport evidence rather than relying only on the ambiguous version list.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix.
- Review Linux distribution guidance and backport status for each deployed kernel build.
- Prioritize EFI-booted systems using or potentially using the efi_novamap option.
- If updating is delayed, request vendor-supported mitigation guidance; the sources name no workaround.
Validation and detection
- Inventory running kernel builds and identify systems booting through the EFI libstub.
- Determine whether efi_novamap is configured on candidate systems.
- Verify vendor packages include the applicable upstream stable fix or equivalent guard.
- After updating, confirm systems rebooted into the corrected kernel build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-33619 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b8938d6f570f010a1dcdbfed3e5b5d3258c2a908CVE reference, Linux
- https://git.kernel.org/stable/c/9dce01f386c9ce6990c0a83fa14b1c95330b037eCVE reference, Linux
- https://git.kernel.org/stable/c/6ca67a5fe1c606d1fbe24c30a9fc0bdc43a18554CVE reference, Linux
- https://git.kernel.org/stable/c/4b2543f7e1e6b91cfc8dd1696e3cdf01c3ac8974CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.