CVE-2024-56741

What it actually does

Unfreed kmemdup allocation inside aa_unpack_strdup causes persistent kernel memory leaks when test cases exercise policy unpacking with null or named strings.

Why it matters to the business

Kernel test runs on Debian 11 systems can gradually exhaust memory, slowing or destabilizing CI pipelines and developer workstations that execute kunit tests; production kernels are unaffected.

How an attack unfolds

An attacker with the ability to trigger kunit test execution (typically local or in a controlled test environment) repeatedly invokes the affected test functions, causing repeated allocations that are never released and leading to memory pressure.

How to fix it

Upgrade linux packages on Debian 11 to version 5.10.234-1 or later; rebuild and reinstall any custom kernels incorporating the fix for aa_unpack_strdup in the AppArmor test code.

How to confirm the fix worked

After upgrade, run the affected kunit tests under kmemleak and confirm no new unreferenced objects matching the backtrace to aa_unpack_strdup; verify package version matches or exceeds 5.10.234-1.

Typical attack path

1. Gain local access or control of a build/test environment running the vulnerable kernel
2. Execute or trigger the policy_unpack_test_unpack_strdup_with_null_name or policy_unpack_test_unpack_strdup_with_name kunit cases
3. Repeat test invocation to accumulate unreferenced allocations
4. Observe gradual memory exhaustion via kmemleak or system monitoring

How to detect it

Inspect kmemleak reports for allocations whose backtrace includes aa_unpack_strdup and kunit_try_catch; review kernel logs for repeated test execution of policy_unpack_test functions on systems running the vulnerable package.

What your security team should do

• Prioritize patching all Debian 11 systems used for kernel testing within normal change windows
• Add kmemleak scans to CI pipelines that execute kunit tests
• Monitor EPSS trend and any new threat actor mentions even though current exploitation maturity is none