Memory leak in Linux kernel usb gadget driver



| Updated: 2025-05-12
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-42236
CWE-ID CWE-401
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Memory leak

EUVDB-ID: #VU95502

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usb_string_copy() function in drivers/usb/gadget/configfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.19 - 6.6.40

CPE2.3 External links

https://git.kernel.org/stable/c/a444c3fc264119801575ab086e03fb4952f23fd0
https://git.kernel.org/stable/c/c95fbdde87e39e5e0ae27f28bf6711edfb985caa
https://git.kernel.org/stable/c/e8474a10c535e6a2024c3b06e37e4a3a23beb490
https://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce
https://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70
https://git.kernel.org/stable/c/d1205033e912f9332c1dbefa812e6ceb0575ce0a
https://git.kernel.org/stable/c/eecfefad0953b2f31aaefa058f7f348ff39c4bba
https://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.318
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.222
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.163
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.280
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.100
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.41


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###