CVE-2024-50165: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a memory leak vulnerability (CVE-2024-50165) was discovered in the BPF filesystem mount options parsing functionality. The issue occurs in the bpfparseparam() function where param->string value is not properly preserved when parsing mount options, leading to a memory leak of the kmalloc area (Kernel Git).

The vulnerability exists in the bpfparseparam() function within the kernel/bpf/inode.c file. When parsing mount options, the function fails to maintain the original param->string pointer, causing allocated memory to be leaked. The CVSS v3.1 base score for this vulnerability is 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability results in a memory leak of the kmalloc area, which can lead to resource exhaustion over time. The leaked memory is not properly freed, potentially causing system resource depletion and degraded performance (Kernel Git).

The issue has been fixed in the Linux kernel by preserving the param->string value during mount options parsing. The fix involves keeping a separate pointer to the original string while using strsep() for parsing. Users should update to patched kernel versions that include the fix (Kernel Git).