Memory Leak Vulnerability in Linux Kernel Affecting Debian Packages
Summary
DEBIAN-CVE-2010-5321: Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system and is critical for system stability and performance. This vulnerability affects versions of the Linux kernel from 2.6.x to 4.x, specifically in the videobuf subsystem, which handles video buffer management.
Vulnerability Detail
The vulnerability, identified as CVE-2010-5321, is a memory leak in the videobuf subsystem of the Linux kernel. It allows local users to exploit /dev/video access through a series of mmap calls that require new memory allocations. This can lead to a denial of service due to excessive memory consumption. The issue is particularly concerning as it affects 11 drivers that have not transitioned to the updated videobuf2 framework, making them susceptible to this exploit.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can limit access to /dev/video for untrusted users to prevent exploitation of this vulnerability. This can be done by modifying the permissions of the /dev/video device files using the command: 'sudo chmod 600 /dev/video*'.
Conclusion
CVE-2010-5321 is a significant memory leak vulnerability in the Linux kernel that affects Debian packages. Users are advised to update their systems to the latest patched version of the Linux kernel to mitigate the risk of denial of service. Implementing workarounds can provide temporary relief while awaiting updates.
See every vulnerability recorded for linux →
FAQ
CVE-2010-5321 is a vulnerability in the Linux kernel that allows local users to cause a denial of service due to a memory leak in the videobuf subsystem.
The vulnerability affects Linux kernel versions from 2.6.x through 4.x.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The primary impact is a denial of service due to excessive memory consumption, which can lead to system instability and performance degradation.
Yes, updating the Linux package to a patched version is the permanent fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
