CVE-2024-26896: linux-libc-dev - Fix Memory Leak When Starting AP
Summary
CVE-2024-26896: In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, ji... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel's C library. It is an essential component for building and running applications on Linux systems. The package is widely used and is included in various Linux distributions.
This vulnerability affects the linux-libc-dev package version 6.1.90-1.
Vulnerability Detail
The vulnerability (CVE-2024-26896) in the linux-libc-dev package has been identified and resolved. The issue specifically relates to the wifi functionality, more specifically the wfx module, in the Linux kernel. The vulnerability results in a memory leak when starting an access point (AP).
The memory leak was reported by Kmemleak, which identified unreferenced objects and reported the following error:
- Unreferenced object 0xd73d1180 (size 184):
- Comm: "wpa_supplicant"
- PID: 1559
- Jiffies: 13006305
The issue is caused by memory allocated by the ieee80211_beacon_get() function not being released, leading to a memory leak. This leak can potentially result in memory exhaustion and degraded system performance.
The vulnerability has a CVSS score of 4.4, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The linux-libc-dev package version 6.1.90-1 is affected by a memory leak vulnerability when starting an access point (AP) using the wifi functionality in the Linux kernel. This vulnerability has been resolved in the latest version of the package. To mitigate the risk, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel's C library.
The vulnerability can result in a memory leak when starting an access point (AP) using the wifi functionality in the Linux kernel. This can lead to memory exhaustion and degraded system performance.
To fix the vulnerability, update the linux-libc-dev package to version 6.1.90-1 or later. Follow the standard package management procedures for your Linux distribution to perform the update.
The CVSS score of this vulnerability is 4.4, indicating a medium severity level.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2024-26896
Related vulnerabilities
Recent vulnerabilities recorded for linux.
