CVE-2024-43913: nvme: apple: fix device reference counting
In the Linux kernel, the following vulnerability has been resolved:
nvme: apple: fix device reference counting
Drivers must call nvmeuninitctrl after a successful nvmeinitctrl. Split the allocation side out to make the error handling boundary easier to navigate. The apple driver had been doing this wrong, leaking the controller device memory on a tagset failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43913?
CVE-2024-43913 has a medium severity level due to potential issues in device reference counting in the Linux kernel.
How do I fix CVE-2024-43913?
To fix CVE-2024-43913, ensure that drivers are modified to call nvme_uninit_ctrl after successfully executing nvme_init_ctrl.
Which versions of the Linux kernel are affected by CVE-2024-43913?
CVE-2024-43913 affects Linux kernel versions prior to 6.10.5.
What distributions are impacted by CVE-2024-43913?
CVE-2024-43913 impacts Debian Linux systems running versions up to 6.1.123-1.
Is a patch available for CVE-2024-43913?
Yes, patches are available in the latest versions of the Linux kernel to address CVE-2024-43913.