CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
In the Linux kernel, the following vulnerability has been resolved:
xen: Fix the issue of resource not being properly released in xenbusdevprobe()
This patch fixes an issue in the function xenbusdevprobe(). In the xenbusdevprobe() function, within the if (err) branch at line 313, the program incorrectly returns err directly without releasing the resources allocated by err = drv->probe(dev, id). As the return value is non-zero, the upper layers assume the processing logic has failed. However, the probe operation was performed earlier without a corresponding remove operation. Since the probe actually allocates resources, failing to perform the remove operation could lead to problems.
To fix this issue, we followed the resource release logic of the xenbusdevremove() function by adding a new block failremove before the failput block. After entering the branch if (err) at line 313, the function will use a goto statement to jump to the failremove block, ensuring that the previously acquired resources are correctly released, thus preventing the reference count leak.
This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and detecting potential issues where resources are not properly managed. In this case, the tool flagged the missing release operation as a potential problem, which led to the development of this patch.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53198?
CVE-2024-53198 is considered a moderate severity vulnerability due to improper resource management.
How do I fix CVE-2024-53198?
To fix CVE-2024-53198, upgrade to the affected Linux kernel versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
What versions of the Linux kernel are affected by CVE-2024-53198?
CVE-2024-53198 affects the Linux kernel versions up to 5.10.226-1.
What functionality is impacted by CVE-2024-53198?
CVE-2024-53198 affects the xenbus_dev_probe() function in the Linux kernel, which can lead to resource mishandling.
Is there a patch available for CVE-2024-53198?
Yes, a patch has been released that addresses the vulnerability in the Linux kernel.