CVE-2024-36967

in linux kernel, tpm2_key_encode() has a memory leak due to 'scratch' never being freed. This can lead to denial of service.

This vulnerability is rated as Moderate impact because exploiting the issue requires local access to trusted key operations on systems configured with TPM 2.0, restricting the blast radius to a denial of service via kernel memory exhaustion without impacting system confidentiality or data integrity. Environments lacking TPM 2.0 capabilities are not exposed, as the affected routines are only executed during TPM-backed trusted key generation and serialization. In standard Red Hat Enterprise Linux deployments, continuous invocation of these key operations is uncommon and typically limited to specialized cryptographic workflows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.