CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit()
In the Linux kernel, the following vulnerability has been resolved:
net: systemport: fix potential memory leak in bcmsysportxmit()
The bcmsysportxmit() returns NETDEVTXOK without freeing skb in case of dmamapsingle() fails, add devkfreeskb() to fix it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Configuration
In bcm_sysport_xmit(), if dma_map_single() fails, add dev_kfree_skb() to free the skb before returning to prevent a potential memory leak.
Linux kernel (net: systemport) bcm_sysport_xmit() skb freeing on dma_map_single() failure = Ensure dev_kfree_skb() is called when dma_map_single() fails (instead of returning NETDEV_TX_OK without freeing the skb)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50171?
CVE-2024-50171 has been categorized as a low severity vulnerability due to its potential memory leak in the Linux kernel.
How do I fix CVE-2024-50171?
To fix CVE-2024-50171, update your Linux kernel to a version that incorporates the fix for bcm_sysport_xmit().
Which Linux kernel versions are affected by CVE-2024-50171?
CVE-2024-50171 affects multiple versions of the Linux kernel, including those before 3.16 and between 4.19 and 6.12-rc3.
Is CVE-2024-50171 a critical vulnerability?
No, CVE-2024-50171 is not classified as a critical vulnerability, rather it poses a low risk primarily due to a memory leak.
What component of the Linux kernel is impacted by CVE-2024-50171?
CVE-2024-50171 specifically impacts the net subsystem, particularly the bcm_sysport_xmit() function.