Memory Leak Vulnerability in Linux Kernel - Package: linux
Summary
DEBIAN-CVE-2024-57872: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() This will ensure that the scsi host is cleaned up properly using scsi_host_dev_release(). Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to significant system issues, including memory leaks, which can degrade performance and reliability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI subsystem, specifically related to the UFS (Universal Flash Storage) platform. The issue arises during the removal of the UFS host bus adapter (HBA) in the function ufshcd_pltfrm_remove(). If the cleanup process is not executed correctly using scsi_host_dev_release(), it can lead to memory leaks, potentially affecting system performance and stability. This vulnerability is critical as it may allow for resource exhaustion over time, impacting the overall functionality of the system.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's SCSI subsystem poses a risk of memory leaks, which can impact system performance. It is essential to update to the patched version (6.12.5-1) to ensure system stability and security. Regular monitoring with tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory leaks, which may degrade system performance and stability over time.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.12.5-1 of the linux package.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57872.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
