Security readout for executives and security teams
Plain-English summary
A Linux media-driver setup error can leave allocated memory unreleased when device registration or video initialization fails. Systems using affected ttpci budget_av code may experience memory pressure or reduced stability. The supplied CVSS describes a local, low-privilege attack path, not remote exploitation.
Executive priority
Prioritize remediation on systems that use the affected media-driver path, particularly stability-sensitive hosts. Broad emergency action is not supported by the supplied evidence because exploitation is local, active exploitation is unreported, and exposure depends on specific driver initialization failures.
Technical view
In budget_av_attach, failure paths for saa7146_register_device and saa7146_vv_init do not release allocated resources, producing two memory leaks. Upstream Linux stable commits add the missing cleanup. Exploitation requires local access under the supplied CVSS vector and depends on reaching these initialization failures.
Likely exposure
Exposure is limited to systems containing affected Linux kernel code where the ttpci budget_av path can execute. The supplied version list is ambiguous and should not alone determine package status; distribution kernels may backport fixes without matching upstream version numbers.
Exploitation context
CVE-2024-27073 is not listed in KEV, and the supplied sources do not report active exploitation. Its CVSS vector indicates local access, low complexity, low privileges, and no user interaction. The specific initialization failure paths must be reached.
Researcher notes
The technical description establishes two resource leaks in error handling. Although the supplied CVSS assigns high confidentiality, integrity, and availability impacts, the sources provided explain only memory leakage; they do not substantiate data disclosure or modification. No CWE is supplied, and affected-version interpretation requires vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable upstream fix.
- Consult distribution guidance, including the Debian advisory where applicable, for packaged remediation.
- If updating is delayed, request supported temporary mitigation guidance from the kernel or distribution vendor.
Validation and detection
- Inventory running kernel builds on systems where ttpci media support is present or used.
- Verify each distribution kernel contains the applicable branch-specific fixing commit or documented backport.
- Confirm updated systems are running the remediated kernel, not merely storing it on disk.
- Reassess package status using vendor advisories rather than upstream version numbers alone.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27073 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/af37aed04997e644f7e1b52b696b62dcae3cc016CVE reference, Linux
- https://git.kernel.org/stable/c/910363473e4bf97da3c350e08d915546dd6cc30bCVE reference, Linux
- https://git.kernel.org/stable/c/24e51d6eb578b82ff292927f14b9f5ec05a46bebCVE reference, Linux
- https://git.kernel.org/stable/c/55ca0c7eae8499bb96f4e5d9b26af95e89c4e6a0CVE reference, Linux
- https://git.kernel.org/stable/c/7393c681f9aa05ffe2385e8716989565eed2fe06CVE reference, Linux
- https://git.kernel.org/stable/c/1597cd1a88cfcdc4bf8b1b44cd458fed9a5a5d63CVE reference, Linux
- https://git.kernel.org/stable/c/656b8cc123d7635dd399d9f02594f27aa797ac3cCVE reference, Linux
- https://git.kernel.org/stable/c/d0b07f712bf61e1a3cf23c87c663791c42e50837CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.