CVE-2024-36967 Details

A memory leak vulnerability has been identified in the Linux kernel's handling of trusted keys, specifically within the TPM2 key encoding function. The issue arises because the 'scratch' buffer used in the encoding process is not properly freed, leading to a memory leak. This vulnerability affects the Linux kernel stable tree, particularly in versions through 5.13. The root cause of the vulnerability is the failure to deallocate memory in both successful and error cases of the key encoding function, which can be exploited by causing the function to exit prematurely without freeing the allocated buffer.

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed by modifying the TPM2 key encoding function to ensure that the 'scratch' buffer is properly freed in all cases.