CVE-2024-50190

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-50190
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50190.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-50190
Downstream
Related
Published
2024-11-08T05:43:46.911Z
Modified
2026-05-15T11:54:40.006511252Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ice: fix memleak in ice_init_tx_topology()
Details

In the Linux kernel, the following vulnerability has been resolved:

ice: fix memleak in iceinittx_topology()

Fix leak of the FW blob (DDP pkg).

Make icecfgtxtopo() const-correct, so iceinittxtopology() can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer allocated for the read of the current topology.

This was found by kmemleak, with the following trace for each PF: [<ffffffff8761044d>] kmemdupnoprof+0x1d/0x50 [<ffffffffc0a0a480>] iceinitddpconfig+0x100/0x220 [ice] [<ffffffffc0a0da7f>] iceinitdev+0x6f/0x200 [ice] [<ffffffffc0a0dc49>] iceinit+0x29/0x560 [ice] [<ffffffffc0a10c1d>] iceprobe+0x21d/0x310 [ice]

Constify icecfgtx_topo() @buf parameter. This cascades further down to few more functions.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50190.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.10.0
Fixed
6.11.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50190.json"