CVE-2024-56745

PCI: Fix reset_method_store() memory leak

Low · published December 29, 2024

CVSS v3.1
3.3
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix reset_method_store() memory leak

In reset_method_store(), a string is allocated via kstrndup() and assigned

to the local "options". options is then used in with strsep() to find

spaces:

while ((name = strsep(&options, " ")) != NULL) {

If there are no remaining spaces, then options is set to NULL by strsep(),

so the subsequent kfree(options) doesn't free the memory allocated via

kstrndup().

Fix by using a separate tmp_options to iterate with strsep() so options is

preserved.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Published
2024-12-29T11:30Z
EPSS history
Timeline
  • 29 DEC 11:30Z
    PCI: Fix reset_method_store() memory leak
    cvelistv5