PT-2023-8295 · Linux+2 · Linux Kernel+2

Jay Shin + 1 · Published 2023-11-07 · Updated 2024-05-20 · CVE-2024-0443

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw was found in the blkgs destruction path in block/blk-cgroup.c, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup rstat flush() is only called at css release work fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with local access to cause system instability, such as an out of memory error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-401

CWE-668

CWE-402

Related Identifiers

BDU:2024-00379

CESA-2023_7077

CVE-2024-0443

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023:7370

RHSA-2023_6583

RHSA-2023_7077

Affected Products

Centos

Linux Kernel

Red Hat

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2024-0443 · Security Note
• https://access.redhat.com/errata/RHSA-2023:7077 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:6583 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-0443 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-0443 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-0443 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00379 · Security Note
• https://ubuntu.com/security/CVE-2024-0443 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7370 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-0443 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0443 · Vendor Advisory
• https://twitter.com/CVEnew/status/1745591090067980552 · Twitter Post
• https://vuldb.com/ru/?id.250483 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2257968 · Note
• https://linuxkernelcves.com/cves/CVE-2024-0443 · Note