Memory Leak Vulnerability in Linux Kernel - CVE-2021-47070
Summary
CVE-2021-47070: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix another memory leak in error handling paths Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. This vulnerability specifically affects the 'uio_hv_generic' driver, which is responsible for handling user-space I/O operations in Hyper-V environments. The vulnerability arises from a memory leak that occurs during error handling, potentially leading to resource exhaustion.
Vulnerability Detail
CVE-2021-47070 is a memory leak vulnerability in the Linux kernel's uio_hv_generic driver. The issue originates from the 'vmbus_alloc_ring()' function, where memory allocated at the beginning of the probe function is not freed in the error handling path. This oversight can lead to increased memory consumption, which may eventually exhaust system resources and degrade performance. The vulnerability has been addressed by adding a missing 'vmbus_free_ring()' call in the error handling path, ensuring that allocated memory is properly released.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best approach is to apply the fix by updating the Linux package as described above.
Conclusion
CVE-2021-47070 is a significant memory leak vulnerability in the Linux kernel that can lead to resource exhaustion. It is crucial for users to update their systems to the latest version of the Linux package to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47070 is a memory leak vulnerability in the Linux kernel's uio_hv_generic driver that can lead to resource exhaustion.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The vulnerability can lead to increased memory usage, which may exhaust system resources and degrade overall system performance.
Yes, a patch is available in the latest versions of the Linux package. Ensure you update to the fixed version.
While there are no specific workarounds, it is advisable to monitor system performance and resource usage until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
