CVE-2024-44969: s390/sclp: Prevent release of buffer in I/O
In the Linux kernel, the following vulnerability has been resolved:
s390/sclp: Prevent release of buffer in I/O
When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due to a hardware or firmware problem, there is a chance that the SCLP facility might store data into buffers referenced by the original operation at a later time.
Handle this situation by not releasing the referenced data buffers if the halt attempt fails. For current use cases, this might result in a leak of few pages of memory in case of a rare hardware/firmware malfunction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.167.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44969?
CVE-2024-44969 has a severity rating that requires immediate attention but is not classified as critical.
How do I fix CVE-2024-44969?
To fix CVE-2024-44969, upgrade your Linux kernel to a version that includes the patch, specifically versions 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which versions of the Linux kernel are affected by CVE-2024-44969?
CVE-2024-44969 affects Linux kernel versions prior to 4.19.320 and between 4.20 and 6.10.5, including a range in between.
Is CVE-2024-44969 exploitable remotely?
There is no public information indicating that CVE-2024-44969 is exploitable remotely.
What systems are vulnerable to CVE-2024-44969?
Systems running vulnerable versions of the Linux kernel including those specified in the affected software details are at risk for CVE-2024-44969.