Reference Count Leak in Linux Kernel's ice_dpll_init_rclk_pins Function
Summary
DEBIAN-CVE-2024-50021: In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins() This patch addresses a reference count handling issue in the ice_dpll_init_rclk_pins... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the system, including device drivers, system calls, and process management. The kernel is critical for system stability and performance. The vulnerability in question affects the 'linux' package in Debian versions 13 and 14, specifically within the ice driver, which is responsible for managing Intel Ethernet devices.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the ice_dpll_init_rclk_pins() function, which improperly handled reference counting. When the function calls ice_dpll_get_pins(), it increments the reference count of the resources. However, if the condition WARN_ON((!vsi || !vsi->netdev)) is met, the function returns an error without releasing the resources acquired, leading to a reference count leak. This can result in resource exhaustion and instability in the system, as resources are not properly managed and released.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability identified in the Linux kernel's ice driver poses a significant risk due to improper reference count handling. It is crucial for users of Debian versions 13 and 14 to update their systems to the patched version 6.11.4-1 to ensure stability and security. Regular monitoring with tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of reference counts in the ice_dpll_init_rclk_pins() function, leading to potential resource leaks.
Debian versions 13 and 14 of the Linux kernel are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to resource exhaustion, system instability, and degraded performance due to unmanageable resource leaks.
Yes, a patch is available in version 6.11.4-1 of the Linux package. It is recommended to update to this version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
