CVE-2024-50084
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
29/10/2024
Last modified:
11/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()<br />
<br />
Commit a3c1e45156ad ("net: microchip: vcap: Fix use-after-free error in<br />
kunit test") fixed the use-after-free error, but introduced below<br />
memory leaks by removing necessary vcap_free_rule(), add it to fix it.<br />
<br />
unreferenced object 0xffffff80ca58b700 (size 192):<br />
comm "kunit_try_catch", pid 1215, jiffies 4294898264<br />
hex dump (first 32 bytes):<br />
00 12 7a 00 05 00 00 00 0a 00 00 00 64 00 00 00 ..z.........d...<br />
00 00 00 00 00 00 00 00 00 04 0b cc 80 ff ff ff ................<br />
backtrace (crc 9c09c3fe):<br />
[] kmemleak_alloc+0x34/0x40<br />
[] __kmalloc_cache_noprof+0x26c/0x2f4<br />
[] vcap_alloc_rule+0x3cc/0x9c4<br />
[] vcap_api_encode_rule_test+0x1ac/0x16b0<br />
[] kunit_try_run_case+0x13c/0x3ac<br />
[] kunit_generic_run_threadfn_adapter+0x80/0xec<br />
[] kthread+0x2e8/0x374<br />
[] ret_from_fork+0x10/0x20<br />
unreferenced object 0xffffff80cc0b0400 (size 64):<br />
comm "kunit_try_catch", pid 1215, jiffies 4294898265<br />
hex dump (first 32 bytes):<br />
80 04 0b cc 80 ff ff ff 18 b7 58 ca 80 ff ff ff ..........X.....<br />
39 00 00 00 02 00 00 00 06 05 04 03 02 01 ff ff 9...............<br />
backtrace (crc daf014e9):<br />
[] kmemleak_alloc+0x34/0x40<br />
[] __kmalloc_cache_noprof+0x26c/0x2f4<br />
[] vcap_rule_add_key+0x2cc/0x528<br />
[] vcap_api_encode_rule_test+0x224/0x16b0<br />
[] kunit_try_run_case+0x13c/0x3ac<br />
[] kunit_generic_run_threadfn_adapter+0x80/0xec<br />
[] kthread+0x2e8/0x374<br />
[] ret_from_fork+0x10/0x20<br />
unreferenced object 0xffffff80cc0b0700 (size 64):<br />
comm "kunit_try_catch", pid 1215, jiffies 4294898265<br />
hex dump (first 32 bytes):<br />
80 07 0b cc 80 ff ff ff 28 b7 58 ca 80 ff ff ff ........(.X.....<br />
3c 00 00 00 00 00 00 00 01 2f 03 b3 ec ff ff ff
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.51 (including) | 6.6.58 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.10.10 (including) | 6.11 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.11.5 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



