Memory Leakage Vulnerability in Linux Kernel - Debian Packages
Summary
DEBIAN-CVE-2024-0443: A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. Affects linux versions < 6.3.11-1. Fixed in 6.3.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It facilitates communication between software and hardware, ensuring system stability and performance. The kernel is continuously updated to address security vulnerabilities and improve functionality. However, vulnerabilities can arise, such as the one identified in this report, which affects the blkgs destruction path in the kernel's block cgroup management.
Vulnerability Detail
A flaw was discovered in the blkgs destruction path within the Linux kernel, specifically in the block/blk-cgroup.c file. This vulnerability leads to a memory leakage issue when a control group (cgroup) is destroyed. The function cgroup_rstat_flush() is only invoked when the blkcg reference count reaches zero, creating a circular dependency that prevents the proper freeing of blkcg and certain blkgs after they are taken offline. This could allow an attacker with local access to exploit the situation, potentially causing system instability, including out-of-memory errors.
How To Fix
Minimum fixed version
6.3.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package as described above.
Conclusion
In summary, a memory leakage vulnerability has been identified in the Linux kernel affecting Debian packages. It is crucial to update to the patched version 6.3.11-1 to protect against potential exploitation that could lead to system instability. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leakage issue in the Linux kernel's block cgroup management, which can lead to system instability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
An attacker with local access could exploit this vulnerability to cause system instability, potentially leading to out-of-memory errors.
Yes, the patched version of the Linux package is 6.3.11-1 for both Debian 13 and 14.
While there are no specific workarounds, it is advisable to apply the patch as soon as possible to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
