{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53198", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.015Z", "datePublished": "2024-12-27T13:49:40.339Z", "dateUpdated": "2026-08-05T11:44:34.804Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:34.804Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: Fix the issue of resource not being properly released in xenbus_dev_probe()\n\nThis patch fixes an issue in the function xenbus_dev_probe(). In the\nxenbus_dev_probe() function, within the if (err) branch at line 313, the\nprogram incorrectly returns err directly without releasing the resources\nallocated by err = drv->probe(dev, id). As the return value is non-zero,\nthe upper layers assume the processing logic has failed. However, the probe\noperation was performed earlier without a corresponding remove operation.\nSince the probe actually allocates resources, failing to perform the remove\noperation could lead to problems.\n\nTo fix this issue, we followed the resource release logic of the\nxenbus_dev_remove() function by adding a new block fail_remove before the\nfail_put block. After entering the branch if (err) at line 313, the\nfunction will use a goto statement to jump to the fail_remove block,\nensuring that the previously acquired resources are correctly released,\nthus preventing the reference count leak.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the Xen paravirtual bus probe path, reached through local xenstore access (/dev/xen/xenbus, xenfs) and sysfs driver bind/unbind or device hotplug within the domain. There is no network-facing path to xenbus_dev_probe().\nAC:L - An attacker who can influence xenstore or induce memory pressure can deterministically make watch_otherend() fail (kvasprintf ENOMEM, or xs_watch returning EINVAL/E2BIG on an over-long path or exhausted per-domain watch quota), and probe can be re-triggered repeatedly via bind/unbind. No condition outside the attacker's influence is required.\nPR:L - A local unprivileged user can create the allocation-failure condition that makes the watch registration fail while ordinary device probe/hotplug/resume activity drives xenbus_dev_probe(); no capability check guards the vulnerable error path itself.\nUI:N - The probe path runs automatically on device discovery, hotplug and resume, and can be re-driven by the attacker; no action by another user is required.\nS:U - The leaked resources and the resulting dangling-pointer accesses are all within the same kernel's security authority; no hypervisor or IOMMU boundary is crossed by the defect itself.\nC:H - The orphaned xenstore watch (blkback's backend_watch, pciback's be_watch) keeps a dangling pointer to a struct xenbus_device that is later kfree()d, so the watch callback performs use-after-free reads of dev->nodename/dev->otherend_id and echoes them into xenstore, exposing reclaimed kernel heap contents that an attacker can groom.\nI:H - The same dangling pointer is written through — xenbus_dev_fatal() reaches __xenbus_switch_state() which stores into dev->state, and dev_err() walks the freed struct device — giving a use-after-free write into a reallocated object, the classic primitive for heap corruption and control-flow hijack.\nA:H - The missing drv->remove() leaks event channels, grant references and kernel objects on every repeated probe failure, and the surviving watch dereferencing freed memory causes an oops or panic when it later fires." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/xen/xenbus/xenbus_probe.c" ], "versions": [ { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "87106169b4ce26f85561f953d13d1fd86d99b612", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "0aa9e30b5b4af5dd504801689d6d84c584290a45", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "e8823e6ff313465910edea07581627d85e68d9fd", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "3fc0996d2fefe61219375fd650601724b8cf2d30", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "804b96f8d0a02fa10b92f28b2e042f9128ed3ffc", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "217bdce88b104269b73603b84d0ab4dd04f481bc", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "2f977a4c82d35d063f5fe198bbc501c4b1c5ea0e", "status": "affected", "versionType": "git" }, { "version": "4bac07c993d03434ea902d3d4290d9e45944b66c", "lessThan": "afc545da381ba0c651b2658966ac737032676f01", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/xen/xenbus/xenbus_probe.c" ], "versions": [ { "version": "2.6.23", "status": "affected" }, { "version": "0", "lessThan": "2.6.23", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "5.4.287" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "5.10.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/87106169b4ce26f85561f953d13d1fd86d99b612" }, { "url": "https://git.kernel.org/stable/c/0aa9e30b5b4af5dd504801689d6d84c584290a45" }, { "url": "https://git.kernel.org/stable/c/e8823e6ff313465910edea07581627d85e68d9fd" }, { "url": "https://git.kernel.org/stable/c/3fc0996d2fefe61219375fd650601724b8cf2d30" }, { "url": "https://git.kernel.org/stable/c/804b96f8d0a02fa10b92f28b2e042f9128ed3ffc" }, { "url": "https://git.kernel.org/stable/c/217bdce88b104269b73603b84d0ab4dd04f481bc" }, { "url": "https://git.kernel.org/stable/c/2f977a4c82d35d063f5fe198bbc501c4b1c5ea0e" }, { "url": "https://git.kernel.org/stable/c/afc545da381ba0c651b2658966ac737032676f01" } ], "title": "xen: Fix the issue of resource not being properly released in xenbus_dev_probe()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53198", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:04:00.609421Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:20.627Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:47:32.708Z" } } ] } }