CVE-2024-53202

What it actually does

Resource leak in fw_log_firmware_info() where a crypto algorithm instance allocated via crypto_alloc_shash is not released with crypto_free_shash on subsequent kmalloc failure, leaving the instance allocated.

Why it matters to the business

Low-risk memory or handle exhaustion on error paths in affected Linux kernels; minimal operational disruption given low EPSS, stable trend, and absence from KEV or ransomware campaigns despite listed threat actor interest in similar kernel issues.

How an attack unfolds

An attacker would need to trigger the specific error path in firmware loading that causes kmalloc to fail after algorithm allocation; no public exploitation observed and listed threat actors reference broader kernel resource and bounds issues rather than this specific leak.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 11.2.202.632ubuntu0.14.04.1 or later; apply equivalent kernel updates that include the fix for the firmware_loader resource leak.

How to confirm the fix worked

Confirm presence of the corrected firmware_loader code that unconditionally calls crypto_free_shash on the error path; review kernel build logs or package manifests for the listed fixed version.

Typical attack path

1. Reach firmware loading code path that invokes fw_log_firmware_info()
2. Force kmalloc failure after crypto algorithm allocation
3. Observe gradual resource consumption without explicit cleanup

How to detect it

Review kernel logs and firmware loading traces for repeated allocation failures around crypto algorithm setup without corresponding frees; no specific exploitation artifacts are documented.

What your security team should do

• Apply the listed fixed package version immediately on any remaining Ubuntu 14.04 systems
• Scan for any custom firmware loading paths that could exercise the error branch
• Monitor EPSS and KEV updates given the kernel family and listed threat actor interest in similar issues