#VU94086 Memory leak in Linux kernel - CVE-2024-39493

Vulnerability identifier: #VU94086

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39493

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the adf_device_reset_worker() and adf_dev_aer_schedule_reset() functions in drivers/crypto/qat/qat_common/adf_aer.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0ce5964b82f212f4df6a9813f09a0b5de15bd9c8
https://git.kernel.org/stable/c/6396b33e98c096bff9c253ed49c008247963492a
https://git.kernel.org/stable/c/a718b6d2a329e069b27d9049a71be5931e71d960
https://git.kernel.org/stable/c/3fb4601e0db10d4fe25e46f3fa308d40d37366bd
https://git.kernel.org/stable/c/e7428e7e3fe94a5089dc12ffe5bc31574d2315ad
https://git.kernel.org/stable/c/c2d443aa1ae3175c13a665f3a24b8acd759ce9c3
https://git.kernel.org/stable/c/d0fd124972724cce0d48b9865ce3e273ef69e246
https://git.kernel.org/stable/c/d3b17c6d9dddc2db3670bc9be628b122416a3d26

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.