CVE-2024-0443

Katalog CVE

CVSS 5.5 · Medium EPSS 0,25%

Kerentanan Transmission of Private Resources into a New Sphere ('Resource Leak') pada linux kernel, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.

Rincian

Terbit di NVD

12 Januari 2024

Terakhir diubah

21 Juli 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:7077 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2024-0443 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2257968 issue tracking · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2023:6583
• https://access.redhat.com/errata/RHSA-2023:7370
• https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com/ mailing list