CVE-2024-39493: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak

Q: What is the severity of CVE-2024-39493?

CVE-2024-39493 has been categorized as a medium severity vulnerability in the Linux kernel.

Q: How do I fix CVE-2024-39493?

To fix CVE-2024-39493, update to the latest Linux kernel versions available, such as 5.10.223-1 or 6.1.123-1.

Q: What versions of the Linux kernel are affected by CVE-2024-39493?

Versions of the Linux kernel from 4.19.312 up to 4.19.316, 5.4.274 up to 5.4.278, 5.10.215 up to 5.10.219, and other specified ranges are affected by CVE-2024-39493.

Q: What is the potential impact of exploiting CVE-2024-39493?

Exploiting CVE-2024-39493 could lead to a memory leak in the kernel's crypto subsystem.

Q: Who is affected by CVE-2024-39493?

Any users running the affected versions of the Linux kernel in environments utilizing the crypto subsystem are at risk from CVE-2024-39493.

Published Jul 10, 2024

Updated

crypto: qat - Fix ADFDEVRESETSYNC memory leak

Affected Software

14 affected componentsFixes available

Linux Linux kernel>=4.19.312<4.19.316

Linux Linux kernel>=5.4.274<5.4.278

Linux Linux kernel>=5.10.215<5.10.219

Linux Linux kernel>=5.15.154<5.15.161

Linux Linux kernel>=6.1.84<6.1.94

Linux Linux kernel>=6.6.24<6.6.34

Linux Linux kernel>=6.9<6.9.5

Microsoft cbl2 kernel 5.15.160.1-1

Patch available

Microsoft cbl2 kernel 5.15.160.1-1

Patch available

Microsoft cbl2 kernel 5.15.162.2-1

Patch available

debian/linux<6.1.94-1

6.1.94-1

debian/linux<6.9.7-1

6.9.7-1

debian/linux<6.9.7-1

6.9.7-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.94-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.9.7-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Compensating control
Change the caller to use cancel_work_sync before freeing the ADF_DEV_RESET_SYNC-related memory, ensuring the work has completed and preventing a use-after-free.

Event History

Jul 10, 2024

CVE Published

via MITRE·07:18 AM

Data Sourced

via MITRE·07:18 AM

Description

Data Sourced

via NVD·08:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·08:15 AM

DescriptionSeverityAffected Software

Aug 8, 2024

Data Sourced

via Microsoft·07:00 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5730

Frequently Asked Questions

What is the severity of CVE-2024-39493?

CVE-2024-39493 has been categorized as a medium severity vulnerability in the Linux kernel.

How do I fix CVE-2024-39493?

To fix CVE-2024-39493, update to the latest Linux kernel versions available, such as 5.10.223-1 or 6.1.123-1.

What versions of the Linux kernel are affected by CVE-2024-39493?

Versions of the Linux kernel from 4.19.312 up to 4.19.316, 5.4.274 up to 5.4.278, 5.10.215 up to 5.10.219, and other specified ranges are affected by CVE-2024-39493.

What is the potential impact of exploiting CVE-2024-39493?

Exploiting CVE-2024-39493 could lead to a memory leak in the kernel's crypto subsystem.

Who is affected by CVE-2024-39493?

Any users running the affected versions of the Linux kernel in environments utilizing the crypto subsystem are at risk from CVE-2024-39493.

CVE-2024-39493: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2024-39493?

How do I fix CVE-2024-39493?

What versions of the Linux kernel are affected by CVE-2024-39493?

What is the potential impact of exploiting CVE-2024-39493?

Who is affected by CVE-2024-39493?

Company

Resources

Contact