Executive brief
A vulnerability in the Linux kernel's media subsystem could allow a local user to cause a system memory leak. This occurs in the Test Pattern Generator (TPG) component, which is used for video handling. Over time, an attacker could exploit this to exhaust system resources, potentially leading to a system crash or denial of service.
Technical details
A memory leak vulnerability (CWE-401) exists in the Linux kernel's media subsystem, specifically within the V4L2 Test Pattern Generator (TPG) core. The root cause is located in the 'tpg_alloc' function in 'drivers/media/common/v4l2-tpg/v4l2-tpg-core.c', where resources allocated within loops are not properly deallocated if an error occurs during subsequent allocation steps. Because 'tpg_free' is only invoked when 'tpg_alloc' returns successfully, failed allocation attempts result in leaked memory. A local attacker with low privileges can trigger these error paths to cause kernel memory exhaustion, leading to a denial of service (DoS). The issue has been patched across multiple stable kernel branches by adding proper goto labels for resource cleanup in error-handling paths.
Affected products
- Linux Linux Kernel 3.18 to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-05-01: disclosed
- 2024-03-26: patched: Date of commit in stable branches
References
- https://git.kernel.org/stable/c/0de691ff547d86dd54c24b40a81f9c925df8dd77
- https://git.kernel.org/stable/c/31096da07933598da8522c54bd007376fb152a09
- https://git.kernel.org/stable/c/4c86c772fef06f5d7a66151bac42366825db0941
- https://git.kernel.org/stable/c/622b1cf38521569869c8f7b9fbe9e4f1a289add7
- https://git.kernel.org/stable/c/6bf5c2fade8ed53b2d26fa9875e5b04f36c7145d
- https://git.kernel.org/stable/c/770a57922ce36a8476c43f7400b6501c554ea511
- https://git.kernel.org/stable/c/8269ab16415f2065cd792c49b0475543936cbd79