ZeroHour

CVE-2023-53078

CVSS 3.1
5.5 medium
EPSS
<1%p9
Published
()
Modified
Description

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [ ] alua_activate+0xb0/0x320 [ ] scsi_dh_activate+0xb2/0x140 [ ] activate_path_work+0xc6/0xe0 [dm_multipath] [ ] process_one_work+0x3c5/0x730 [ ] worker_thread+0x93/0x650 [ ] kthread+0x1ba/0x210 [ ] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path.

Vendors
linux
Products
linux kernel
Weakness
CWE-401
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In the news

No ingested article mentions this CVE yet.