Security readout for executives and security teams
Plain-English summary
A Linux EFI boot component can free the wrong memory pointer while handling a command-line processing failure. Because that pointer may reference the caller’s stack, successful abuse could corrupt memory and compromise confidentiality, integrity, or availability. Exploitation requires local access, privileges, and a difficult failure condition; this is not described as remotely exploitable.
Executive priority
Treat this as a high-priority kernel maintenance issue, but not an emergency comparable to an actively exploited remote flaw. Accelerate remediation on shared or locally accessible EFI-booted systems. Follow normal tested kernel rollout procedures because exploitation evidence is absent and successful abuse appears constrained.
Technical view
Within efi/libstub failure cleanup, cmdline_ptr is an output parameter likely referencing caller stack memory. The vulnerable path passes it to free_pool() instead of the allocated cmdline buffer. The correction frees cmdline. CVSS 3.1 is 7.0: local vector, high complexity, low privileges, no user interaction, unchanged scope, and high potential impact.
Likely exposure
Exposure is limited to affected Linux kernels using the EFI libstub and reaching the relevant failure-cleanup path. The source lists 6.2, 6.6.64, 6.12.4, 6.13, and an ambiguous “0” entry as affected. Distribution backports may change actual status, so version strings alone are insufficient.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector indicates an attacker would need local, low-privileged access and overcome high attack complexity. The exact trigger conditions and practical exploitability are not established by the supplied sources.
Researcher notes
The defect is an invalid-free condition in EFI libstub error handling: an out-parameter potentially pointing into caller stack memory is freed instead of the pool allocation. No CWE is assigned in the supplied record. Affected-version data is imprecise and includes duplicated commit entries and an ambiguous “0,” requiring branch and backport verification.
Mitigation direction
- Apply a vendor-supported kernel containing the cited stable correction or an equivalent backport.
- Check Linux distribution security guidance for package-specific fixed versions.
- Prioritize EFI-booted systems where untrusted users have local access.
- Use supported kernels and avoid relying solely on upstream version numbers.
Validation and detection
- Inventory kernel package versions on systems that boot through EFI.
- Confirm whether the distribution package includes one of the cited fixes or an equivalent backport.
- Verify remediation against the distribution’s security advisory or package changelog.
- After updating, confirm the intended kernel is active and EFI boot remains operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-56573 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376aCVE reference, Linux
- https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cfCVE reference, Linux
- https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.