Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_kernel | Linux | 3.13 | * |
| Linux_kernel | Linux | * | * |
| Linux_kernel | Linux | 3.3 | * |
| Linux_kernel | Linux | 3.12 | * |
| Linux_kernel | Linux | 3.17 | * |
| Linux_kernel | Linux | 3.19 | * |