Memory Leak Vulnerability in Linux Kernel - Package: linux
Summary
DEBIAN-CVE-2024-41023: In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --min... Affects linux versions < 6.9.10-1. Fixed in 6.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities that may affect system performance and security. This particular vulnerability affects the 'linux' package in Debian versions 13 and 14, highlighting a memory leak issue that arises during specific stress tests.
Vulnerability Detail
In the Linux kernel, a memory leak occurs due to improper handling of the task_struct reference count in the sched/deadline scheduling class. When the start_dl_timer() function is called, it increments the reference count of task_struct and sets a timer. If the timer is canceled before it expires (for example, by calling enqueue_task_dl()), the reference count is not decremented, leading to a memory leak. This can result in increased memory usage and potential system instability over time, especially under heavy load.
How To Fix
Minimum fixed version
6.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk of memory leaks.
Conclusion
The memory leak vulnerability in the Linux kernel's task_struct handling poses a risk to system stability and performance. It is essential to update the affected 'linux' package to the patched version 6.9.10-1 to mitigate this issue. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a memory leak, which may increase memory usage and potentially cause system instability over time, particularly under heavy workloads.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in version 6.9.10-1 of the linux package. Updating to this version will resolve the vulnerability.
While there are no specific workarounds mentioned, it is crucial to monitor your system's memory usage and apply the patch as soon as possible to mitigate risks.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41023.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
