In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
Jan Schunk reports that his small NFS servers suffer from memory
exhaustion after just a few days. A bisect shows that commit
e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single
sock_sendmsg() call") is the first bad commit.
That commit assumed that sock_sendmsg() releases all the pages in
the underlying bio_vec array, but the reality is that it doesn't.
svc_xprt_release() releases the rqst's response pages, but the
record marker page fragment isn't one of those, so it is never
released.
This is a narrow fix that can be applied to stable kernels. A
more extensive fix is in the works.
References
| Link | Resource |
|---|---|
| https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861 | Patch Mailing List |
| https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861 | Patch Mailing List |
| https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8 | Patch Mailing List |
| https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8 | Patch Mailing List |
| https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882 | Patch Mailing List |
| https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882 | Patch Mailing List |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 09:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861 - Patch, Mailing List | |
| References | () https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882 - Patch, Mailing List | |
| References | () https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8 - Patch, Mailing List |
19 May 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-19 09:15
Updated : 2024-11-21 09:21
NVD link : CVE-2024-35882
Mitre link : CVE-2024-35882
JSON object : View
Products Affected
linux
- linux_kernel
CWE
No CWE.