Memory Leak Vulnerability in Linux Kernel: bnxt_en Package Affected
Summary
DEBIAN-CVE-2024-35972: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() If ulp = kzalloc() fails, the allocated edev will leak because it is not properly assig... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware resources and provides essential services for software applications. It is widely used in various distributions, including Debian. The bnxt_en driver is responsible for managing network devices, ensuring efficient data transmission and reception. This vulnerability poses a risk to system stability and performance due to a potential memory leak in the driver.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the bnxt_en driver, specifically in the function bnxt_rdma_aux_device_init(). If the memory allocation function kzalloc() fails, the allocated device structure (edev) is not properly assigned, leading to a memory leak. This can result in increased memory usage over time, potentially causing system slowdowns or crashes. The vulnerability is classified as a memory leak, which is critical to address to maintain system performance and reliability.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The memory leak vulnerability in the bnxt_en driver of the Linux kernel poses a significant risk to system performance and stability. It is crucial to update to the patched version 6.8.9-1 to mitigate this issue. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the bnxt_en driver of the Linux kernel, which can lead to increased memory usage and potential system instability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring installation.
If left unaddressed, the memory leak can lead to degraded system performance, increased memory consumption, and potential crashes.
Yes, you need to install version 6.8.9-1 of the Linux package to fix this vulnerability.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities, making it easier to maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
