CVE-2024-57872

What it actually does

Failure to deallocate the UFS HBA in ufshcd_pltfrm_remove() prevents scsi_host_dev_release() from cleaning up the SCSI host, resulting in a memory leak classified as MemoryCorruption.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems using UFS storage controllers can lead to performance degradation, unexpected process terminations, or system instability, increasing operational overhead especially on long-running servers.

How an attack unfolds

An attacker with local access triggers repeated insertion and removal of the UFS platform driver (for example via module unload or device hotplug events) to accumulate leaked memory structures without triggering any remote network vectors.

How to fix it

Apply the kernel patch that ensures HBA deallocation occurs inside ufshcd_pltfrm_remove(); for chromium-browser on Ubuntu 14.04 LTS upgrade to version 58.0.3029.81-0ubuntu0.14.04.1172 or later.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the ufshcd_pltfrm_remove() function for the scsi_host_dev_release() call and verify no memory growth occurs during repeated driver unload cycles.

Typical attack path

1. Obtain local access to a system with UFS storage
2. Repeatedly load and unload the ufshcd_pltfrm module or trigger device removal events
3. Monitor for increasing memory consumption without corresponding process growth
4. Continue until system resources are exhausted or stability is impacted

How to detect it

Review kernel logs for repeated ufshcd_pltfrm_remove entries without corresponding host release messages; correlate with system memory counters showing unexplained growth during driver lifecycle events.

What your security team should do

• Prioritize patching kernel packages on all systems exposing UFS controllers
• Monitor memory usage trends on production hosts after applying updates
• Review any downstream package dependencies that pull in the affected UFS platform code