CVE-2024-50190: ice: fix memleak in ice_init_tx_topology()
In the Linux kernel, the following vulnerability has been resolved:
ice: fix memleak in iceinittxtopology()
Fix leak of the FW blob (DDP pkg).
Make icecfgtxtopo() const-correct, so iceinittxtopology() can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer allocated for the read of the current topology.
This was found by kmemleak, with the following trace for each PF: [<ffffffff8761044d>] kmemdupnoprof+0x1d/0x50 [<ffffffffc0a0a480>] iceinitddpconfig+0x100/0x220 [ice] [<ffffffffc0a0da7f>] iceinitdev+0x6f/0x200 [ice] [<ffffffffc0a0dc49>] iceinit+0x29/0x560 [ice] [<ffffffffc0a10c1d>] iceprobe+0x21d/0x310 [ice]
Constify icecfgtxtopo() @buf parameter. This cascades further down to few more functions.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50190?
CVE-2024-50190 has not been officially assigned a severity rating yet, but it addresses a memory leak issue.
How do I fix CVE-2024-50190?
To fix CVE-2024-50190, update the Linux Kernel to version 6.12-rc1 or later, or apply relevant patches.
What is the impact of CVE-2024-50190?
CVE-2024-50190 could potentially lead to resource exhaustion due to the memory leak in the ice driver.
Which versions of the Linux Kernel are affected by CVE-2024-50190?
The affected versions include Linux Kernel versions 6.10 to 6.11.4 and 6.12-rc1, 6.12-rc2.
Who is responsible for addressing CVE-2024-50190?
The maintainers of the Linux Kernel are responsible for addressing and providing updates for CVE-2024-50190.