Memory Leak Vulnerability in Linux Kernel's SPI GPIO Driver
Summary
DEBIAN-CVE-2019-19070: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering devm_add_action_or_reset() fail... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. The 'linux' package in Debian distributions provides the kernel functionality necessary for system operations. This package is crucial for system stability and performance, and vulnerabilities within it can lead to significant security risks.
Vulnerability Detail
A memory leak in the spi_gpio_probe() function within the Linux kernel, specifically in the drivers/spi/spi-gpio.c file, has been identified. This vulnerability, tracked as CVE-2019-19070, allows attackers to exploit the system by causing a denial of service through excessive memory consumption. The issue arises when devm_add_action_or_reset() fails, leading to unhandled memory leaks. Notably, the vulnerability requires the system to be low on memory before exploitation can occur, which raises questions about its practical impact.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, monitoring system memory usage and ensuring adequate resources can help mitigate potential denial of service scenarios.
Conclusion
The memory leak vulnerability in the Linux kernel's SPI GPIO driver poses a risk of denial of service due to excessive memory consumption. Users are advised to update their Linux packages to mitigate this issue. Regular monitoring and resource management can also help reduce the impact of such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2019-19070 is a memory leak vulnerability in the Linux kernel's SPI GPIO driver that can lead to denial of service.
If exploited, this vulnerability can cause your system to run out of memory, leading to crashes or unresponsiveness.
Versions of the Linux kernel up to 5.3.11 are affected. Check your kernel version using 'uname -r' in the terminal.
If updating is not possible, ensure that your system has sufficient memory and monitor its usage closely.
More details can be found in the Debian CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
