CVE-2024-43869 — Missing Release of Memory after Effective Lifetime in Linux
CWE-401 — Missing Release of Memory after Effective LifetimeCWE-402 — Resource Leak25 documents6 sources
Severity
5.5MEDIUMNVD
OSV8.8OSV7.1
EPSS
0.0%
top 98.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 21
Latest updateJan 9
Description
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix event leak upon exec and file release
The perf pending task work is never waited upon the matching event
release. In the case of a child event, released via free_event()
directly, this can potentially result in a leaked event, such as in the
following scenario that doesn't even require a weak IRQ work
implementation to trigger:
schedule()
prepare_task_switch()
=======>
perf_event_overflow()
event->pending_sigtrap = …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages6 packages
▶CVEListV5linux/linux8bffa95ac19ff27c8261904f89d36c7fcf215d59 — 9ad46f1fef421d43cdab3a7d1744b2f43b54dae0+6