CWE-415: Double Free, page 9
Filter
The product calls free() twice on the same memory address.
What the weakness is: CWE-415 at MITRE
Ask an AI about CWE-415
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-415: Double Free and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/415.html and https://cve.bz/cve/cwe/415?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2024-50055EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, f…
- 7.8CVE-2024-49989EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during amdgpu module unload Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible li…
- 7.8CVE-2024-49983EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated b…
- 7.8CVE-2024-49882EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released…
- 7.8CVE-2024-49853EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stac…
- 5.9CVE-2024-3187EPSS 0.5%
This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the ME_GOAHEAD_JAVA…
- 9.8CVE-2024-45402EPSS 0.5%
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may …
- 7.8CVE-2024-43514EPSS 0.6%
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
- 6.7CVE-2024-23379EPSS 0.1%
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
- 7.5CVE-2024-20498EPSS 0.5%
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an af…
- 7.8CVE-2024-46741EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf' In fastrpc_req_mmap() e…
- 7.8CVE-2024-46736EPSS 0.6%
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable…
- 7.8CVE-2024-46687EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() [BUG] There is an internal report that KASAN is reporting use-after-free, with the following …
- 7.8CVE-2024-46673EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventuall…
- 7.8CVE-2024-38247EPSS 0.7%
Windows Graphics Component Elevation of Privilege Vulnerability
- 4.4CVE-2023-7256EPSS 0.2%
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() …
- 7.8CVE-2022-48919EPSS 0.5%
In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually …
- 7.8CVE-2022-48892EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: sched/core: Fix use-after-free bug in dup_user_cpus_ptr() Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems"), the settin…
- 7.0CVE-2024-38157EPSS 0.5%
Azure IoT SDK Remote Code Execution Vulnerability
- 5.5CVE-2024-42234EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I've been seeing elusive "Bad page state"s (often on flags when freeing, yet the flags shown…
- 4.2CVE-2024-41965EPSS 0.3%
Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim m…
- 5.3CVE-2024-41957EPSS 0.4%
Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that …
- 7.8CVE-2024-42147EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/debugfs - Fix debugfs uninit process issue During the zip probe process, the debugfs failure does not stop the probe. When debugfs initialization fails…
- 7.8CVE-2024-42138EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init() deallocates memory but doesn't …
- 4.4CVE-2024-42123EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix double free err_addr pointer warnings In amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages will be run many times so that double free …
- 5.5CVE-2023-52888EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Only free buffer VA that is not NULL In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called only when the buffer to free ex…
- 7.8CVE-2024-41087EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error If e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump to the err_out label, which will call devres_release…
- 7.8CVE-2024-41073EPSS 0.7%
In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will resul…
- 7.8CVE-2024-41046EPSS 0.5%
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released m…
- 7.8CVE-2024-40940EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail In case of flow rule creation fail in mlx5_lag_create_port_sel_table(), instead of previously cr…
- 8.8CVE-2024-38087EPSS 1.7%
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- 8.8CVE-2024-30013EPSS 1.6%
Windows MultiPoint Services Remote Code Execution Vulnerability
- 7.8CVE-2024-21461EPSS 0.1%
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
- 7.8CVE-2024-23141EPSS 0.4%
A maliciously crafted MODEL file, when parsed in libodxdll through Autodesk applications, can cause a double free. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
- 5.5CVE-2024-39292EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list…
- 7.8CVE-2024-38627EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next li…
- 7.8CVE-2022-48740EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: selinux: fix double free of cond_list on error paths On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second …
- 7.8CVE-2021-47589EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_ne…
- 7.8CVE-2024-36973EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() When auxiliary_device_add() returns error and then calls auxiliary_device_uninit()…
- 8.8CVE-2024-30097EPSS 1.7%
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
- 7.8CVE-2024-36940EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is free…
- 7.1CVE-2024-36030EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix the double free in rvu_npc_freemem() Clang static checker(scan-build) warning： drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2 …
- 7.8CVE-2021-47564EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix double free issue on err path fix error path handling in prestera_bridge_port_join() that cases prestera driver to crash (see below). Trace…
- 7.8CVE-2021-47483EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to …
- 8.8CVE-2024-27127EPSS 0.7%
A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute arbitrary code via a network. We have already fixed the vulnerabili…
- 7.8CVE-2023-52851EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_…
- 7.8CVE-2023-52795EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_…
- 5.5CVE-2023-52739EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: Fix page corruption caused by racy check in __free_pages When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad…
- 5.5CVE-2021-47304EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized This commit fixes a bug (found by syzkaller) that could cause spurious double-initializations for congestio…
- 7.8CVE-2024-35856EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Fix double free of skb in coredump hci_devcd_append() would free the skb on error so the caller don't have to free it again otherwise it woul…