CVE-2024-41023

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: Fix task_struct reference leak

During the execution of the following stress test with linux-rt:

stress-ng --cyclic 30 --timeout 30 --minimize --quiet

kmemleak frequently reported a memory leak concerning the task_struct:

unreferenced object 0xffff8881305b8000 (size 16136):

comm "stress-ng", pid 614, jiffies 4294883961 (age 286.412s)

object hex dump (first 32 bytes):

02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@..............

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

debug hex dump (first 16 bytes):

53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S...............

backtrace:

[<00000000046b6790>] dup_task_struct+0x30/0x540

[<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0

[<00000000ced59777>] kernel_clone+0xb0/0x770

[<00000000a50befdc>] __do_sys_clone+0xb6/0xf0

[<000000001dbf2008>] do_syscall_64+0x5d/0xf0

[<00000000552900ff>] entr

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References