CVE-2024-56747

Summary

CVE-2024-56747 is a vulnerability affecting the Linux kernel's SCSI subsystem. The issue lies in the qedi driver, where a memory leak occurs during the initialization of sb_virt in qedi_alloc_and_init_sb(). The hook "qedi_ops->common->sb_init = qed_sb_init" fails to release the DMA memory upon failure. This omission is inconsistent with other memory allocation functions like qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Consequentially, the system may run out of memory over time, leading to potential instability or crashes. To mitigate this issue, the Linux kernel development team has resolved it by adding dma_free_coherent() to properly free the allocated DMA memory.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.