CVE-2024-24891

What it actually does

Resource leak in the TCM driver (drivers/staging/gmjstcm/tcm.c) allows an authorized local actor to read kernel memory contents that should have been freed.

Why it matters to the business

Attackers who already have elevated local access can obtain kernel-level secrets, increasing the chance of further privilege escalation or data theft on affected openEuler systems.

How an attack unfolds

An attacker with local high-privilege access triggers the TCM driver path that fails to release allocated buffers, then reads the still-resident sensitive kernel data through the exposed interface.

How to fix it

Upgrade the openEuler kernel to version 4.19.90-2403.4.0.0244 or later; if the driver is not required, disable or remove the gmjstcm module.

How to confirm the fix worked

Confirm the running kernel version is at or above 4.19.90-2403.4.0.0244 and verify that the tcm.c resource cleanup paths have been applied; test that the driver no longer returns previously freed memory contents.

Typical attack path

1. Obtain local shell with root or equivalent privileges on an affected openEuler kernel
2. Load or exercise the staging gmjstcm TCM driver
3. Trigger the resource allocation path that leaks memory
4. Read the leaked kernel memory region to extract sensitive information

How to detect it

Review kernel logs and audit records for unexpected access to the gmjstcm TCM driver; look for processes exercising the staging driver shortly before or after privilege-escalation events.

What your security team should do

• Apply the kernel update to 4.19.90-2403.4.0.0244 or newer as the primary fix
• Audit systems for the presence of the staging gmjstcm driver and remove it if unused
• Monitor local privilege abuse attempts that could reach the driver