CyberSecBulletin
CVE-2024-27073NVD status: Modified

Linux: Missing Release of Memory after Effective Lifetime

Published Updated By the CyberSecBulletin desk

CVE-2024-27073 is a high-severity missing release of memory after effective lifetime vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions af37aed04997e644f7e1b52b696b62dcae3cc016, 910363473e4bf97da3c350e08d915546dd6cc30b, 24e51d6eb578b82ff292927f14b9f5ec05a46beb as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to af37aed04997e644f7e1b52b696b62dcae3cc016 or 910363473e4bf97da3c350e08d915546dd6cc30b or 24e51d6eb578b82ff292927f14b9f5ec05a46beb or 55ca0c7eae8499bb96f4e5d9b26af95e89c4e6a0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.273 or 5.10.214 or 5.15.153 or 6.1.83, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, af37aed04997e644f7e1b52b696b62dcae3cc016; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 910363473e4bf97da3c350e08d915546dd6cc30b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 24e51d6eb578b82ff292927f14b9f5ec05a46beb; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 55ca0c7eae8499bb96f4e5d9b26af95e89c4e6a0; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 7393c681f9aa05ffe2385e8716989565eed2fe06; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 1597cd1a88cfcdc4bf8b1b44cd458fed9a5a5d63; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 656b8cc123d7635dd399d9f02594f27aa797ac3c; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, d0b07f712bf61e1a3cf23c87c663791c42e50837; and 1 more rangesaf37aed04997e644f7e1b52b696b62dcae3cc016, 910363473e4bf97da3c350e08d915546dd6cc30b, 24e51d6eb578b82ff292927f14b9f5ec05a46beb, 55ca0c7eae8499bb96f4e5d9b26af95e89c4e6a0, 7393c681f9aa05ffe2385e8716989565eed2fe06, 1597cd1a88cfcdc4bf8b1b44cd458fed9a5a5d63
LinuxLinux Kernel2.6.12 up to, but not including, 5.4.273; 5.5 up to, but not including, 5.10.214; 5.11 up to, but not including, 5.15.153; 5.16 up to, but not including, 6.1.83; 6.2 up to, but not including, 6.6.23; 6.7 up to, but not including, 6.7.11; 6.8 up to, but not including, 6.8.25.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11
DebianDebian Linux10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.15.5MediumCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of ttpci_budget_init does. Besides, there are two fixme comment refers to such deallocations.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

How developers prevent this class of flaw

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC). To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

More Missing Release of Memory after Effective Lifetime vulnerabilities (CWE-401)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Missing Release of Memory after Effective Lifetime vulnerabilities

Spotted an error? Tell us.