CVE-2024-35829 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-35829?

CVE-2024-35829 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's Lima graphics driver. When lima_vm_map_bo fails during memory allocation, resources aren't properly deallocated, leading to gradual memory exhaustion. This affects systems using the Lima driver for ARM Mali graphics hardware.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's Lima graphics driver. When lima_vm_map_bo fails during memory allocation, resources aren't properly deallocated, leading to gradual memory exhaustion. This affects systems using the Lima driver for ARM Mali graphics hardware.

💻 Affected Systems

Products:

Linux kernel with Lima DRM driver enabled

Versions: Linux kernel versions with vulnerable Lima driver code (specific commit range)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if Lima DRM driver is compiled and loaded (typically for ARM Mali graphics hardware)

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or potential kernel crashes.

🟠

Likely Case

Gradual memory consumption over time leading to performance degradation and potential application crashes.

🟢

If Mitigated

Minimal impact with proper memory monitoring and restart policies in place.

🌐 Internet-Facing: LOW - Requires local access to trigger the memory leak condition.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability, potentially affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger specific Lima driver operations. No known public exploits.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 04ae3eb470e5, 4ab14eccf557, 746606d37d66, 8e25c0ee5665, or ec6bb037e4a3 applied

Vendor Advisory: https://git.kernel.org/stable/c/04ae3eb470e52a3c41babe85ff8cee195e4dcbea

Restart Required: Yes

Instructions:

1. Update to patched Linux kernel version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify Lima driver is updated.

🔧 Temporary Workarounds

Disable Lima DRM driver

linux

Prevent loading of vulnerable Lima graphics driver module

echo 'blacklist lima' >> /etc/modprobe.d/blacklist-lima.conf
rmmod lima
update-initramfs -u

Restrict user access

linux

Limit which users can access graphics hardware

chmod 600 /dev/dri/renderD128
setfacl -m u:username:rw- /dev/dri/renderD128

🧯 If You Can't Patch

Monitor system memory usage for unusual consumption patterns
Implement regular system reboots to clear accumulated memory leaks

🔍 How to Verify

Check if Vulnerable:

Check if Lima driver is loaded: lsmod | grep lima && check kernel version against patched commits

Check Version:

uname -r && grep -i lima /proc/modules

Verify Fix Applied:

Verify kernel version includes fix commits and Lima driver loads without errors in dmesg

📡 Detection & Monitoring

Log Indicators:

Kernel OOM (Out of Memory) messages in dmesg
Increasing memory usage by kernel processes
Lima driver error messages

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("out of memory" OR "OOM" OR "lima")

📊 Metadata

CVE ID: CVE-2024-35829

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: May 17, 2024

Last Updated: April 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35829, you might also want to check these: