CVE-2024-50190
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
08/11/2024
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ice: fix memleak in ice_init_tx_topology()<br />
<br />
Fix leak of the FW blob (DDP pkg).<br />
<br />
Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid<br />
copying whole FW blob. Copy just the topology section, and only when<br />
needed. Reuse the buffer allocated for the read of the current topology.<br />
<br />
This was found by kmemleak, with the following trace for each PF:<br />
[] kmemdup_noprof+0x1d/0x50<br />
[] ice_init_ddp_config+0x100/0x220 [ice]<br />
[] ice_init_dev+0x6f/0x200 [ice]<br />
[] ice_init+0x29/0x560 [ice]<br />
[] ice_probe+0x21d/0x310 [ice]<br />
<br />
Constify ice_cfg_tx_topo() @buf parameter.<br />
This cascades further down to few more functions.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.10 (including) | 6.11.4 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



