Memory Leak Vulnerability in Linux Kernel's NTFS3 Package - CVE-2021-47660
Summary
CVE-2021-47660: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' All error handling paths lead to 'out' where many resources are freed. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core of many operating systems, providing essential services for hardware and software interaction. The NTFS3 module allows Linux systems to read and write to NTFS file systems, commonly used by Windows. This module is crucial for users who need to access NTFS partitions. However, the NTFS3 implementation has been found to contain a vulnerability that can lead to memory leaks during error handling, potentially affecting system performance and stability.
Vulnerability Detail
CVE-2021-47660 is a vulnerability in the Linux kernel's NTFS3 file system implementation. It arises from improper error handling in the 'log_replay()' function, where certain resources are not freed correctly upon encountering errors. This oversight can lead to memory leaks, where memory that should be released remains allocated, ultimately consuming system resources and potentially leading to degraded performance or system crashes. The vulnerability affects versions prior to 5.18.5-1 and has been addressed in this fixed version.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as possible.
Conclusion
CVE-2021-47660 is a significant vulnerability in the Linux kernel's NTFS3 module that can lead to memory leaks if not addressed. Users are strongly advised to update to the latest patched version to ensure system stability and performance. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your systems.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47660 is a vulnerability in the Linux kernel's NTFS3 module that can lead to memory leaks due to improper error handling.
This vulnerability can cause memory leaks, which may degrade system performance and stability over time.
Versions of the Linux kernel prior to 5.18.5-1 are affected by this vulnerability.
You can check your system's kernel version using the command 'uname -r' in the terminal. If it's below 5.18.5-1, you are vulnerable.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.