Memory Leak Vulnerability in Linux Kernel: Linux Package Affected
Summary
DEBIAN-CVE-2024-50190: In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in ice_init_tx_topology() Fix leak of the FW blob (DDP pkg). Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the Linux package in Debian versions 13 and 14, highlighting a critical issue that could lead to memory leaks and inefficient resource management.
Vulnerability Detail
In the Linux kernel, a memory leak vulnerability was identified in the ice_init_tx_topology() function, which is part of the ice driver. This vulnerability arises from improper handling of firmware blob memory, leading to potential resource exhaustion. The issue was discovered through kmemleak, which traced the memory allocation and showed that the firmware blob was not being released correctly. If exploited, this could result in degraded system performance or crashes due to excessive memory usage.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The memory leak vulnerability in the Linux kernel's ice driver poses a significant risk to system performance and stability. It is crucial for users of Debian versions 13 and 14 to update their Linux packages to the patched version 6.11.4-1 to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the Linux kernel's ice driver, which can lead to resource exhaustion.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to degraded system performance or crashes due to excessive memory usage.
Yes, a patch is available in version 6.11.4-1 of the Linux package.
While there are no specific workarounds, it is recommended to monitor your system closely until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
