PT-2024-36837 · Linux+2 · Linux Kernel+2

Published 2024-11-06 · Updated 2025-02-28 · CVE-2024-56534

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak was found in the Linux kernel's isofs component, specifically in the iocharset parameter. The leak occurs when the opt->iocharset is not freed in certain situations, such as when the isofs fill super function is not called. This can happen, for example, in the get tree bdev flags function when encountering a situation where "Can't mount, would change RO state." The memory leak is caused by the unreferenced object 0xffff0000d10164d8 (size 8). The backtrace shows the call stack leading to the leak, including functions such as kmemleak alloc, kmalloc node track caller noprof, and isofs parse param. To fix the issue, the memory freeing of opt->iocharset has been moved to the isofs free fc function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-15353

CVE-2024-56534

USN-7276-1

USN-7277-1

USN-7310-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 788

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56534.json · Exploit
• https://ubuntu.com/security/CVE-2024-53166 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50185 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50016 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49943 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50249 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50211 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49907 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50277 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-56534 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50145 · Vendor Advisory