CVE-2024-43871 — Missing Release of Memory after Effective Lifetime in Linux
CWE-401 — Missing Release of Memory after Effective LifetimeCWE-402 — Resource Leak39 documents8 sources
Severity
5.5MEDIUMNVD
OSV8.8OSV7.1
EPSS
0.0%
top 95.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 21
Latest updateAug 14
Description
In the Linux kernel, the following vulnerability has been resolved:
devres: Fix memory leakage caused by driver API devm_free_percpu()
It will cause memory leakage when use driver API devm_free_percpu()
to free memory allocated by devm_alloc_percpu(), fixed by using
devres_release() instead of devres_destroy() within devm_free_percpu().
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages10 packages
▶CVEListV5linux/linuxff86aae3b4112b85d2231c23bccbc49589df1c06 — 700e8abd65b10792b2f179ce4e858f2ca2880f85+8