CVE-2024-39484 — Allocation of Resources Without Limits or Throttling in Linux
Severity
5.5MEDIUMNVD
OSV8.4OSV5.3
EPSS
0.0%
top 91.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 5
Latest updateAug 14
Description
In the Linux kernel, the following vulnerability has been resolved:
mmc: davinci: Don't strip remove function when driver is builtin
Using __exit for the remove function results in the remove callback being
discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g.
using sysfs or hotplug), the driver is just removed without the cleanup
being performed. This results in resource leaks. Fix it by compiling in the
remove callback unconditionally.
This also fixes a W=1 modpost warn…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6