Memory Leak Vulnerability in Linux Kernel: BCMA SPI Driver
Summary
DEBIAN-CVE-2024-50170: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix potential memory leak in bcmasp_xmit() The bcmasp_xmit() returns NETDEV_TX_OK without freeing skb in case of mapping fails, add dev_kfr... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, supporting a wide range of devices and architectures. The kernel is crucial for system operations, and vulnerabilities within it can lead to significant security risks, including system crashes and data loss.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the BCMA SPI driver, specifically in the bcmasp_xmit() function. This function can return NETDEV_TX_OK without properly freeing the socket buffer (skb) in cases where mapping fails. This oversight can lead to a memory leak, potentially exhausting system memory resources and affecting overall system performance. The vulnerability is classified under DEBIAN-CVE-2024-50170 and affects both Debian 13 and 14 versions of the Linux package.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package as described above.
Conclusion
The memory leak vulnerability in the Linux kernel's BCMA SPI driver poses a significant risk to system stability and performance. It is crucial for users to update their Linux packages to the patched version 6.11.6-1 to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The memory leak can lead to increased memory consumption, potentially causing system slowdowns or crashes if the available memory is exhausted.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability affects Debian 13 and 14 versions of the Linux package prior to the fixed version 6.11.6-1.
While the primary concern is memory exhaustion, which can lead to system instability, there is a potential risk of data loss if the system crashes unexpectedly.
If immediate updating is not possible, monitor your system's memory usage closely and consider restarting services or the system to free up memory until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
