CVE-2024-0443
Medium
Description
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedJan 12, 2024
First seenJan 12, 2024
Weakness typeCWE-402CWE-402
How to fix
Update
- linux linux_kernel6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 6.2 ≤ v < 6.4, 6.4 | 6.4 |
| redhat enterprise_linux | 8.0, 9.0 | — |
| fedoraproject fedora | 39 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.