LiveActive security incident?Get immediate response
CVE Record

CVE-2024-46673: scsi: aacraid: Fix double-free on probe failure

In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux storage driver can free the same memory twice when initialization fails. This may crash or corrupt an affected system and, under the supplied CVSS assessment, could compromise confidentiality, integrity, and availability. Exposure is limited to systems using the aacraid driver and reaching the relevant probe-failure path.

Executive priority

Treat this as a high-priority kernel maintenance issue for systems using aacraid, especially important storage infrastructure. It is not supported as an internet-facing or actively exploited emergency. Patch through normal expedited maintenance after confirming driver exposure, and use vendor package guidance rather than relying solely on the supplied version list.

Technical view

During aacraid device probing, aac_init_adapter() can free aac_dev::queues after an initialization failure without clearing the pointer. The subsequent aac_probe_one() error path frees that pointer again, creating a kernel double-free. The supplied CVSS 3.1 score is 7.8, with local access and low privileges required.

Likely exposure

Likely exposure is concentrated in Linux systems with the aacraid SCSI driver and applicable storage hardware or configurations. The vulnerable path requires adapter initialization to fail after queue allocation. The supplied affected-version data is broad and internally awkward, so confirm exposure against distribution advisories and the referenced stable-kernel fixes.

Exploitation context

The supplied record does not identify CISA KEV listing or active exploitation. CVSS indicates a local, low-privileged attack context with no user interaction, but the sources do not establish reliable attacker control of the required probe failure or provide evidence of public exploitation.

Researcher notes

The defect is a stale-pointer double-free in an initialization error path, not an ordinary network-reachable flaw. Assess whether unprivileged local activity can influence device probing or initialization failure in the target environment. The provided sources establish the bug and fixes, but do not establish exploit reliability, public proof-of-concept availability, or observed attacks.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable referenced stable-kernel fix.
  • Consult your Linux distributor's advisory for exact fixed package versions.
  • Prioritize systems using aacraid-backed storage or loading the aacraid driver.
  • Apply normal change controls because storage-driver kernel updates may require rebooting.

Validation and detection

  • Inventory kernel versions and identify systems loading or using the aacraid driver.
  • Compare installed kernel packages with distributor advisories and referenced stable fixes.
  • Confirm the updated kernel is active after reboot, not merely installed.
  • Review kernel logs for aacraid probe failures, crashes, or memory-corruption symptoms.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-46673 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-46673Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fab, 8e0c5ebde82b08f6d996e11983890fc4cc085fabunaffected
LinuxLinux2.6.15, 0, 4.19.321, 5.4.283, 5.10.225, 5.15.166, 6.1.108, 6.6.49, 6.10.8, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.