Linux Kernel
CVE-2024-27073
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Memory leak in error path; requires specific legacy hardware present; no confidentiality or integrity impact; only gradual availability degradation possible.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: ttpci: fix two memleaks in budget_av_attach
When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of ttpci_budget_init does. Besides, there are two fixme comment refers to such deallocations.
AnalysisAI
Memory leaks in the Linux kernel's ttpci DVB driver (budget_av_attach) allow a local attacker with access to the affected subsystem to exhaust kernel memory over time. Specifically, when saa7146_register_device or saa7146_vv_init fail during device initialization, allocated resources are never freed due to missing error-path cleanup. The NVD-assigned CVSS score of 7.8 with C:H/I:H/A:H appears significantly inflated for a CWE-401 memory leak in an error path; real-world impact is most plausibly limited to availability degradation. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.28% (20th percentile) corroborates negligible exploitation interest.
Technical ContextAI
The vulnerability resides in the Linux kernel's drivers/media/dvb-frontends/ttpci/budget-av.c module, which implements support for SAA7146-based PCI budget DVB-T/S/C capture cards. CWE-401 (Missing Release of Memory after Effective Lifetime) describes the root cause: two distinct error branches in budget_av_attach - one triggered on failure of saa7146_register_device and another on failure of saa7146_vv_init - omit the corresponding deallocation calls that the main teardown path (ttpci_budget_init error handling) does perform correctly. The result is kernel heap memory being permanently orphaned whenever these failure conditions occur. The saa7146 chipset is legacy PCI multimedia hardware from Philips Semiconductors; this driver path executes only on systems where such hardware is physically present and probed.
RemediationAI
Upgrade to a Linux kernel version containing one of the eight stable-branch patches linked in the NVD references (e.g., commits 1597cd1a, 24e51d6e, 55ca0c7e, 656b8cc1, 7393c681, 910363473, af37aed0, d0b07f71 on git.kernel.org/stable). Debian users should apply available kernel updates via apt-get upgrade and consult the Debian Security Tracker for the specific package version addressing CVE-2024-27073. As a compensating control on systems where patching is delayed, the ttpci kernel module can be blocklisted (echo 'blacklist budget-av' >> /etc/modprobe.d/blacklist.conf) if no supported DVB hardware is present - this eliminates the affected code path entirely at the cost of losing SAA7146-based DVB card functionality. No patch version number beyond the upstream stable commit hashes is independently confirmed from the available data.
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today