Memory leak in Linux kernel - CVE-2024-24891

Vulnerability identifier: #VU88108

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24891

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the tcm_open() function in drivers/staging/gmjstcm/tcm.c. A local user can force the driver to leak memory and perform denial of service attack.

Linux kernel
openEuler
kernel
bpftool-debuginfo
python2-perf-debuginfo
kernel-devel
perf-debuginfo
bpftool
python2-perf
perf
python3-perf
kernel-source
kernel-debugsource
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
kernel-debuginfo
python3-perf-debuginfo

Install updates from vendor's website.

kernel - update to 4.19.90-2403.4.0.0244
bpftool-debuginfo - update to 4.19.90-2403.4.0.0244
python2-perf-debuginfo - update to 4.19.90-2403.4.0.0244
kernel-devel - update to 4.19.90-2403.4.0.0244
perf-debuginfo - update to 4.19.90-2403.4.0.0244
bpftool - update to 4.19.90-2403.4.0.0244
python2-perf - update to 4.19.90-2403.4.0.0244
perf - update to 4.19.90-2403.4.0.0244
python3-perf - update to 4.19.90-2403.4.0.0244
kernel-source - update to 4.19.90-2403.4.0.0244
kernel-debugsource - update to 4.19.90-2403.4.0.0244
kernel-tools - update to 4.19.90-2403.4.0.0244
kernel-tools-debuginfo - update to 4.19.90-2403.4.0.0244
kernel-tools-devel - update to 4.19.90-2403.4.0.0244
kernel-debuginfo - update to 4.19.90-2403.4.0.0244
python3-perf-debuginfo - update to 4.19.90-2403.4.0.0244

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1358

• Multiple vulnerabilities in Linux kernel gmjstcm driver
• openEuler 20.03 LTS SP1 update for kernel