CVE-2024-36967

What it actually does

A memory leak occurs in the tpm2_key_encode() function of the Linux kernel trusted keys subsystem because the allocated 'scratch' buffer is never released on either success or error paths.

Why it matters to the business

Long-running systems that use TPM-backed trusted keys may gradually exhaust available memory, leading to degraded performance, service disruptions, or crashes that affect availability of dependent workloads.

How an attack unfolds

An attacker with local access triggers repeated invocations of the tpm2_key_encode path in the trusted keys code; each call leaks memory without requiring special privileges beyond local execution, eventually causing resource exhaustion.

How to fix it

Upgrade the Linux kernel to a version containing commit 1e6914fa8e7798bcf3ce4a5b96ea4ac1d5571cdf or later; apply the equivalent patch that adds the missing kfree() calls for the scratch buffer in both success and error paths.

How to confirm the fix worked

Inspect the tpm2_key_encode() implementation in the running kernel source to confirm kfree() is present on all paths; verify the installed kernel version includes the referenced commit or apply a configuration test that exercises the function without observing unbounded memory growth.

Typical attack path

1. Obtain local access on a target system
2. Repeatedly exercise operations that invoke tpm2_key_encode() through the trusted keys interface
3. Monitor system memory consumption until exhaustion produces denial of service

How to detect it

Review system and kernel logs for repeated trusted-key operations accompanied by steadily increasing memory usage; examine process memory statistics for processes interacting with the trusted keys subsystem.

What your security team should do

• Prioritize kernel updates on all systems that compile or run the trusted keys subsystem
• Restrict unprivileged local access where TPM key operations are unnecessary
• Monitor memory usage trends on affected hosts and schedule patching within standard change windows