PT-2024-33862 · Linux+4 · Linux Kernel+4
Published
2024-09-30
·
Updated
2025-09-29
·
CVE-2024-50021
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions up to 6.11.3
Description:
The issue concerns a reference count handling problem in the
ice dpll init rclk pins() function. This function calls ice dpll get pins(), which increments the reference count of relevant resources. However, if a specific condition is met, the function returns an error without properly releasing the acquired resources, leading to a reference count leak. The problem was identified using an experimental static analysis tool that specializes in analyzing reference count operations. To resolve this, the check has been moved to the top of the function to verify the state before acquiring resources.Recommendations:
For Linux kernel versions up to 6.11.3, upgrade the affected component to a version that includes the patch for the
ice dpll init rclk pins() function to mitigate the risk. As a temporary workaround, consider restricting access to the ice dpll init rclk pins() function until a patch is available.Exploit
Fix
Missing Release of Resource after Effective Lifetime
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Suse
Ubuntu