Log in Start free

Vulnerability · Published Nov 8, 2024 · Assigned by Linux

CVE-2024-50190ice: fix memleak in ice_init_tx_topology()

Medium 5.5

In plain English

A medium-severity memory leak in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 92.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in ice_init_tx_topology() Fix leak of the FW blob (DDP pkg). Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer allocated for the read of the current topology. This was found by kmemleak, with the following trace for each PF: [<ffffffff8761044d>] kmemdup_noprof+0x1d/0x50 [<ffffffffc0a0a480>] ice_init_ddp_config+0x100/0x220 [ice] [<ffffffffc0a0da7f>] ice_init_dev+0x6f/0x200 [ice] [<ffffffffc0a0dc49>] ice_init+0x29/0x560 [ice] [<ffffffffc0a10c1d>] ice_probe+0x21d/0x310 [ice] Constify ice_cfg_tx_topo() @buf parameter. This cascades further down to few more functions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.11.4-1DEBIAN-CVE-2024-50190
Debian:14linux6.11.4-1DEBIAN-CVE-2024-50190
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50190
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50190
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50190

Affected products (as reported)

VendorProductVersions
Linux Linux cc5776fe183208115e42c044497e193e4671a2b9 – before 43544b4e30732c3d88f423252281915d5bc739b6cc5776fe183208115e42c044497e193e4671a2b9 – before c188afdc36113760873ec78cbc036f6b05f77621
Linux Linux 6.10

Weakness: CWE-401 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References