CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe()

Published Dec 27, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

xen: Fix the issue of resource not being properly released in xenbusdevprobe()

This patch fixes an issue in the function xenbusdevprobe(). In the xenbusdevprobe() function, within the if (err) branch at line 313, the program incorrectly returns err directly without releasing the resources allocated by err = drv->probe(dev, id). As the return value is non-zero, the upper layers assume the processing logic has failed. However, the probe operation was performed earlier without a corresponding remove operation. Since the probe actually allocates resources, failing to perform the remove operation could lead to problems.

To fix this issue, we followed the resource release logic of the xenbusdevremove() function by adding a new block failremove before the failput block. After entering the branch if (err) at line 313, the function will use a goto statement to jump to the failremove block, ensuring that the previously acquired resources are correctly released, thus preventing the reference count leak.

This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and detecting potential issues where resources are not properly managed. In this case, the tool flagged the missing release operation as a potential problem, which led to the development of this patch.

Other sources

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

Launchpad

Affected Software

10 affected componentsFixes available
Linux Kernel
debian/linux<=5.10.223-1
5.10.234-16.1.129-16.1.135-16.12.22-16.12.25-1
debian/linux-6.1
6.1.129-1~deb11u1
Linux Linux kernel>=2.6.23<5.4.287
Linux Linux kernel>=5.5<5.10.231
Linux Linux kernel>=5.11<5.15.174
Linux Linux kernel>=5.16<6.1.120
Linux Linux kernel>=6.2<6.6.64
Linux Linux kernel>=6.7<6.11.11
Linux Linux kernel>=6.12<6.12.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
  2. Upgrade

    Upgrade debian/linux-6.1 to a version that resolves this vulnerability.

    Fixed in 6.1.129-1~deb11u1

Event History

Dec 27, 2024
CVE Published
via MITRE·01:49 PM
Data Sourced
via MITRE·01:49 PM
DescriptionSeverity
Data Sourced
via NVD·02:15 PM
Description
Data Sourced
via NVD·02:15 PM
RemedySeverityWeaknessAffected Software
Mar 28, 2025
Data Sourced
via Launchpad·01:04 AM
Description
Apr 29, 2025
Data Sourced
via Ubuntu·01:11 AM
RemedyDescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-53198?

CVE-2024-53198 is considered a moderate severity vulnerability due to improper resource management.

2

How do I fix CVE-2024-53198?

To fix CVE-2024-53198, upgrade to the affected Linux kernel versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.

3

What versions of the Linux kernel are affected by CVE-2024-53198?

CVE-2024-53198 affects the Linux kernel versions up to 5.10.226-1.

4

What functionality is impacted by CVE-2024-53198?

CVE-2024-53198 affects the xenbus_dev_probe() function in the Linux kernel, which can lead to resource mishandling.

5

Is there a patch available for CVE-2024-53198?

Yes, a patch has been released that addresses the vulnerability in the Linux kernel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203