Linux kernel (drivers/pci): Every write to a device's reset_method sysfs attribute that contains no space leaks the

CVSS 4.0CVE-2024-56745Kernel, userspace & hypervisorcurated

Impact

Every write to a device's reset_method sysfs attribute that contains no space leaks the buffer it allocated, because strsep() has already nulled the pointer that the free uses. The leak is unbounded and driven entirely by the writer, so a loop over that attribute grows kernel memory until the node is under memory pressure - a slow noisy-neighbour outage on a shared host, on the knob that decides how a device is reset between tenants.

Who can reach it

Needs write access to /sys/bus/pci/devices/<dev>/reset_method, which is root-owned - so host root, or a privileged container with /sys mounted writable. Not reachable by a plain tenant container, not reachable from a guest, and not reachable over the fabric. The reason it is worth carrying is the surface rather than the severity: reset_method is the control that determines which reset a device gets when it is reclaimed from one tenant and handed to the next, and it should not be writable from anything a tenant runs.

What to do

Boot a kernel where reset_method_store() iterates over a separate temporary pointer so the original allocation is still freed. Interim: ensure /sys is mounted read-only in containers and that no tenant workload runs with privileges to write PCI sysfs attributes.

References

https://git.kernel.org/stable/c/403efb4457c0c8f8f51e904cc57d39193780c6bd https://git.kernel.org/stable/c/931d07ccffcc3614f20aaf602b31e89754e21c59 https://nvd.nist.gov/vuln/detail/CVE-2024-56745

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.