CVE-2024-50167
Description
A flaw was found in the be2net network driver within the Linux kernel. This vulnerability occurs when the be_xmit() function fails to properly release network packet buffers under specific error conditions. This oversight can lead to a memory leak, which, if continuously triggered, could result in system instability or a Denial of Service (DoS) for affected systems.
Mitigation
To mitigate this issue, if the system does not utilize Broadcom NetXtreme II 10 Gigabit Ethernet adapters, the `be2net` kernel module can be prevented from loading. This can be achieved by creating a blacklist rule.
Create a file named `/etc/modprobe.d/blacklist-be2net.conf` with the following content:
blacklist be2netAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect.
bashThis mitigation may impact network functionality if Broadcom NetXtreme II adapters are in use.
dracut -f -v
reboot
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 5.5 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Most memory leaks result in general product reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing or hanging the program) or take advantage of other unexpected program behavior resulting from a low memory condition.
Other
Technical Impact: Reduce Performance
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
