CVE-2024-50190

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
08/11/2024
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: fix memleak in ice_init_tx_topology()<br /> <br /> Fix leak of the FW blob (DDP pkg).<br /> <br /> Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid<br /> copying whole FW blob. Copy just the topology section, and only when<br /> needed. Reuse the buffer allocated for the read of the current topology.<br /> <br /> This was found by kmemleak, with the following trace for each PF:<br /> [] kmemdup_noprof+0x1d/0x50<br /> [] ice_init_ddp_config+0x100/0x220 [ice]<br /> [] ice_init_dev+0x6f/0x200 [ice]<br /> [] ice_init+0x29/0x560 [ice]<br /> [] ice_probe+0x21d/0x310 [ice]<br /> <br /> Constify ice_cfg_tx_topo() @buf parameter.<br /> This cascades further down to few more functions.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.10 (including) 6.11.4 (excluding)
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*