Linux Kernel up to 6.6.32/6.8.11/6.9.2 et8ek8 remove memory leak

Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 6.6.32/6.8.11/6.9.2. The affected element is the function remove of the component et8ek8. Executing a manipulation can lead to an unknown weakness. This vulnerability appears as CVE-2024-38611. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.6.32/6.8.11/6.9.2 and classified as critical. This vulnerability affects the function remove of the component et8ek8. The CWE definition for the vulnerability is CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: media: i2c: et8ek8: Don't strip remove function when driver is builtin Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text)

The advisory is available at git.kernel.org. This vulnerability was named CVE-2024-38611 since 06/18/2024. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 209060 (Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-7069-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.6.33, 6.8.12 or 6.9.3 eliminates this vulnerability. Applying the patch c1a3803e5bb9/43fff07e4b19/904db2ba44ae/545b215736c5 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (209060) and CERT Bund (WID-SEC-2024-1418). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• IBM InfoSphere Guardium
• Oracle Linux
• Oracle VM
• IBM Security Guardium
• RESF Rocky Linux
• Broadcom Brocade SANnav
• Dell NetWorker
• Open Source Linux Kernel
• IBM QRadar SIEM
• Dell Avamar
• IBM Storage Scale
• Juniper Junos Space
• SolarWinds Security Event Manager
• Dell PowerProtect Data Domain

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.8.8
• 6.8.9
• 6.8.10
• 6.8.11
• 6.9.0
• 6.9.1
• 6.9.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion