CVE-2024-0443
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem.
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.25% probability · 16th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-402, CWE-668
- Affected
- linux/linux kernel · redhat/enterprise linux · fedoraproject/fedora
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2023:6583
- https://access.redhat.com/errata/RHSA-2023:7077Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7370
- https://access.redhat.com/security/cve/CVE-2024-0443Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2257968Issue Tracking, Third Party Advisory
- https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com/Mailing List
- https://access.redhat.com/errata/RHSA-2023:6583
- https://access.redhat.com/errata/RHSA-2023:7077Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:7370
- https://access.redhat.com/security/cve/CVE-2024-0443Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2257968Issue Tracking, Third Party Advisory
- https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com/Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.