Memory Leak Vulnerability in Linux Kernel Package: linux - Thermal Zone Debug Memory Management
Summary
DEBIAN-CVE-2024-36956: In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Free all thermal zone debug memory on zone removal Because thermal_debug_tz_remove() does not free all memory allocated for thermal zon... Affects linux versions < 6.8.11-1. Fixed in 6.8.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is the core of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for facilitating communication between software and hardware components, ensuring efficient operation of the system. The kernel is critical for system stability and performance, making it vital to address any vulnerabilities that may arise.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the thermal zone management system. Specifically, the function thermal_debug_tz_remove() fails to free all allocated memory for thermal zone diagnostics when a thermal zone is removed. This oversight can lead to memory leaks, where unreachable memory remains allocated, potentially exhausting system resources and impacting performance. The issue affects versions prior to 6.8.11-1, and it is crucial for system administrators to address this vulnerability to maintain system integrity and performance.
How To Fix
Minimum fixed version
6.8.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The memory leak vulnerability in the Linux kernel's thermal zone management poses a significant risk to system performance and stability. It is essential for users of Debian 13 and 14 to update their linux package to version 6.8.11-1 or later to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the thermal zone management of the Linux kernel, where not all allocated memory is freed upon removal of a thermal zone.
The vulnerability affects versions of the linux package prior to 6.8.11-1.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
If left unaddressed, the memory leak could lead to increased memory usage, system slowdowns, and potential crashes due to resource exhaustion.
Currently, there are no specific mitigations available. The recommended action is to update to the patched version as soon as it is released.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
