Memory Leak Vulnerability in Linux Kernel: RDMA/bnxt_re Package Affected
Summary
DEBIAN-CVE-2024-50172: In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a possible memory leak In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_db_bar() fails driver is not freeing the memory allocated for "... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including networking, file systems, and device drivers. The RDMA (Remote Direct Memory Access) subsystem allows for high-performance networking, enabling direct memory access from the memory of one computer into that of another without involving the operating system. This vulnerability affects the bnxt_re driver, which is responsible for RDMA operations on certain network devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the bnxt_re driver related to memory management. Specifically, in the function bnxt_re_setup_chip_ctx(), if the call to bnxt_qplib_map_db_bar() fails, the driver does not free the memory allocated for the 'rdev->chip_ctx'. This oversight can lead to a memory leak, potentially exhausting system resources and affecting system stability. The vulnerability is classified under CVE-2024-50172 and has been addressed in the patched version of the package.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the package.
Conclusion
The memory leak vulnerability identified in the Linux kernel's bnxt_re driver (CVE-2024-50172) poses a significant risk to system stability. Users are advised to update their Linux packages to the fixed version (6.11.6-1) to mitigate this issue. Regular updates and monitoring for vulnerabilities are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-50172 is the identifier for a memory leak vulnerability in the Linux kernel's bnxt_re driver, which can lead to resource exhaustion.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability can lead to a memory leak, causing the system to run out of memory and potentially crash or become unresponsive.
While the primary concern is resource exhaustion, there is a potential risk of data loss if the system becomes unresponsive or crashes.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
