Memory Leak Vulnerability in Linux Kernel - CVE-2021-47193
Summary
CVE-2021-47193: In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix memory leak during rmmod Driver failed to release all memory allocated. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is crucial for system stability and performance. This vulnerability specifically affects the SCSI driver 'pm80xx', which is responsible for managing SCSI devices. The failure to properly release allocated memory during the removal of this driver can lead to memory leaks, impacting system performance and stability.
Vulnerability Detail
CVE-2021-47193 is a memory leak vulnerability in the Linux kernel's SCSI driver 'pm80xx'. The issue arises when the driver fails to release all allocated memory upon module removal. This oversight can lead to increased memory consumption over time, potentially exhausting system resources and causing instability. The vulnerability is classified with a CVSS score of 5.5, indicating a moderate severity level. It is essential for system administrators to address this issue to maintain optimal system performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, if you cannot immediately update the kernel, you can avoid loading the 'pm80xx' driver if it is not necessary for your system's operation. This can be done by blacklisting the driver in your system's configuration files. Add the following line to '/etc/modprobe.d/blacklist.conf':
blacklist pm80xx
Then, run 'sudo update-initramfs -u' and reboot your system.
Conclusion
CVE-2021-47193 is a significant memory leak vulnerability in the Linux kernel's SCSI driver 'pm80xx'. It is crucial for users and administrators to update their systems to mitigate the risk of resource exhaustion and maintain system stability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47193 is a memory leak vulnerability in the Linux kernel's SCSI driver 'pm80xx', which can lead to increased memory usage and system instability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The main consequence is a memory leak that can lead to system resource exhaustion, potentially causing performance degradation and instability.
Yes, a patch is available in Linux kernel version 5.15.5-1 and later. It is recommended to update your kernel to this version or higher.
As a temporary measure, you can blacklist the 'pm80xx' driver to prevent it from loading, thereby avoiding the memory leak until you can perform the update.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
