Resource Leak in Linux Kernel's Octeontx2-pf Driver - CVE-2024-35975
Summary
DEBIAN-CVE-2024-35975: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix transmit scheduler resource leak Inorder to support shaping and scheduling, Upon class creation Netdev driver allocates trasmit schedu... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports various drivers, including the octeontx2-pf driver, which manages network devices. This driver is responsible for handling transmit scheduling and resource allocation for network traffic. The vulnerability in question arises from a failure to properly free resources allocated for transmit schedulers, leading to potential resource leaks and degraded system performance.
Vulnerability Detail
In the Linux kernel, specifically within the octeontx2-pf driver, a vulnerability has been identified that causes a resource leak. When a class is deleted, the driver fails to free the transmit schedulers that were allocated for shaping and scheduling network traffic. This oversight can lead to increased memory usage and may eventually exhaust system resources, resulting in degraded performance or system instability. The issue was introduced with a patch that added support for round-robin scheduling but did not account for proper resource management upon class deletion.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to prevent any potential issues.
Conclusion
The CVE-2024-35975 vulnerability in the Linux kernel's octeontx2-pf driver poses a significant risk due to resource leaks that can affect system performance. It is crucial to update to the patched version 6.8.9-1 to ensure system stability and security. Users are encouraged to utilize tools like Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
CVE-2024-35975 is a vulnerability in the Linux kernel's octeontx2-pf driver that causes a resource leak due to improper management of transmit schedulers.
This vulnerability can lead to increased memory usage and may exhaust system resources, potentially causing degraded performance or system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system's resource usage and apply the patch as soon as possible to mitigate risks.
More details can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-35975.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
