LiveActive security incident?Get immediate response
CVE Record

CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe()

In the Linux kernel, the following vulnerability has been resolved: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() This patch fixes an issue in the function xenbus_dev_probe(). In the xenbus_dev_probe() function, within the if (err) branch at line 313, the program incorrectly returns err directly without releasing the resources allocated by err = drv->probe(dev, id). As the return value is non-zero, the upper layers assume the processing logic has failed. However, the probe operation was performed earlier without a corresponding remove operation. Since the probe actually allocates resources, failing to perform the remove operation could lead to problems. To fix this issue, we followed the resource release logic of the xenbus_dev_remove() function by adding a new block fail_remove before the fail_put block. After entering the branch if (err) at line 313, the function will use a goto statement to jump to the fail_remove block, ensuring that the previously acquired resources are correctly released, thus preventing the reference count leak. This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and detecting potential issues where resources are not properly managed. In this case, the tool flagged the missing release operation as a potential problem, which led to the development of this patch.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux Xen device-probing error can leave allocated resources and reference counts unreleased when probing fails. The supplied record rates potential impact as high, but exploitation requires local, low-privileged access and no user interaction. Organizations using Xen-enabled Linux systems should confirm their distribution kernel includes the published correction.

Executive priority

Treat this as a high-priority kernel maintenance issue on Xen infrastructure, especially shared systems permitting lower-privileged local access. It is less urgent for systems without Xen exposure. There is no supplied evidence of active exploitation, so prioritize accurate inventory and tested kernel updates over emergency disruption.

Technical view

In xenbus_dev_probe(), an error returned after drv->probe() previously bypassed the corresponding removal path. The correction adds a fail_remove path before fail_put, following xenbus_dev_remove() cleanup logic and preventing a reference-count leak. The record classifies this as CWE-401 with CVSS 3.1 score 7.8 and vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Likely exposure

Exposure is limited to Linux kernels using the affected Xen bus code. The supplied affected-version data is broad and internally unclear, including repeated commit identifiers and multiple kernel branches. Confirm exposure using the running distribution kernel package, Xen usage, and vendor-specific security status rather than version strings alone.

Exploitation context

The supplied bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector describes a local attack requiring low privileges. The vulnerability was found by experimental static analysis, not reported through observed attacks.

Researcher notes

The defect is a failed-probe cleanup omission causing a reference-count/resource leak. Published fixes span multiple stable branches. The supplied affected-version representation is not sufficiently precise for package-level conclusions; distribution backports may change exposure. No source in the bundle demonstrates exploitability, attack reliability, or observed compromise.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable published stable fix.
  • Review Debian LTS advisories when operating affected Debian releases.
  • Consult your Linux distributor’s guidance for exact fixed package versions.
  • Prioritize Xen hosts where untrusted or lower-privileged local users have access.

Validation and detection

  • Inventory running kernel versions and identify systems using Xen or Xen bus drivers.
  • Compare each kernel package against its distributor’s CVE status and fixed release.
  • Verify the deployed kernel incorporates the applicable upstream stable correction.
  • Confirm patched probe-error handling invokes resource removal before releasing the device reference.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-401: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-53198 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-53198Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66c, 4bac07c993d03434ea902d3d4290d9e45944b66cunaffected
LinuxLinux2.6.23, 0, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2, 6.13affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-401 · source CWE mapping

Missing Release of Memory after Effective Lifetime

Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.