CVE-2024-14027

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s fremovexattr() syscall within the fs/xattr component. Specifically, the function calls fdget() to obtain a file reference but fails to release it using fdput() when strncpy from user() encounters an error while processing the name argument. This results in a permanent leak of a file reference for each call, potentially leading to kernel memory exhaustion in multi-threaded processes. An unprivileged local user can trigger this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.