CVE-2023-52653: Vulnerability in linux-libc-dev - SUNRPC Memleak
Summary
CVE-2023-52653: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only ca... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the necessary C library headers for building the Linux kernel. It includes definitions and structures required for system calls and other kernel interfaces. This package is essential for developers who are building or modifying the Linux kernel. The vulnerability in linux-libc-dev is related to the SUNRPC component, which is responsible for remote procedure call (RPC) support in the kernel.
Vulnerability Detail
The vulnerability (CVE-2023-52653) in linux-libc-dev is a memory leak issue in the SUNRPC component. Specifically, the ctx->mech_used.data allocated by kmemdup is not freed in gss_import_v2_context or its only caller gss_krb5_import_sec_context. This leads to a memory leak as the allocated memory is not properly released. The patch for this vulnerability modifies the last call of gss_import_v2_context to gss_krb5_import_ctx_v2, preventing the memory leak while preserving the return information. This vulnerability can potentially be exploited by an attacker to exhaust system memory resources, leading to denial of service (DoS) conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that their systems are updated with the latest security patches and by following best practices for system hardening and network security.
Conclusion
The vulnerability in linux-libc-dev (CVE-2023-52653) has been identified and addressed. Users are advised to update their linux-libc-dev package to version 6.1.90-1 or later to mitigate the risk of memory leaks and potential denial of service (DoS) conditions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides C library headers for building the Linux kernel. It includes definitions and structures required for system calls and other kernel interfaces.
SUNRPC is a component in the Linux kernel that provides support for remote procedure call (RPC) functionality. It is used for communication between different processes or systems over a network.
The vulnerability in linux-libc-dev can lead to a memory leak, potentially causing system memory exhaustion and denial of service (DoS) conditions.
To fix this vulnerability, update the linux-libc-dev package to version 6.1.90-1 or later. This updated version includes the necessary patch to address the memory leak issue.
There are no specific workarounds mentioned for this vulnerability. However, users can mitigate the risk by keeping their systems updated and following best practices for system hardening and network security.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
