Memory Leak Vulnerability in Linux Kernel's PTP Clock Registration
Summary
CVE-2021-47455: In the Linux kernel, the following vulnerability has been resolved: ptp: Fix possible memory leak in ptp_clock_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff88800906c6... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware resources and providing essential services for software applications. It supports various functionalities, including process management, memory management, and device control. The PTP (Precision Time Protocol) subsystem within the kernel is responsible for high-precision time synchronization across networked devices. This vulnerability affects the PTP clock registration process, potentially leading to memory leaks under specific error conditions.
Vulnerability Detail
In the Linux kernel, a memory leak occurs in the ptp_clock_register() function when posix_clock_register() returns an error. The allocated name in dev_set_name() is not freed, leading to unreferenced memory objects persisting in the system. This can result in increased memory usage and potential system instability over time. The vulnerability was identified during fault injection testing, revealing that the memory allocated for device names was not properly released, which could affect system performance and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the kernel update as soon as it is available.
Conclusion
The CVE-2021-47455 vulnerability in the Linux kernel's PTP clock registration process poses a risk of memory leaks, which can affect system performance. Users are advised to update their kernel to mitigate this issue. Monitoring tools like Vulert can help in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47455 is a vulnerability in the Linux kernel that can lead to a memory leak during the PTP clock registration process.
This vulnerability can lead to increased memory usage over time, potentially causing system instability or performance degradation.
You should update your Linux kernel to a version that includes the fix for this vulnerability, specifically to version 5.14.16-1 or later.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
