Memory Leak Vulnerability in Linux Kernel's FEC Driver - CVE-2023-52998
Summary
CVE-2023-52998: In the Linux kernel, the following vulnerability has been resolved: net: fec: Use page_pool_put_full_page when freeing rx buffers The page_pool_release_page was used when freeing rx buffers, and this function just unmaps... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system. The FEC (Fast Ethernet Controller) driver is responsible for managing Ethernet connections. This vulnerability affects the memory management within the FEC driver, leading to potential system instability and memory exhaustion.
Vulnerability Detail
CVE-2023-52998 is a vulnerability in the Linux kernel's FEC driver, where the function page_pool_release_page was incorrectly used to free receive (rx) buffers. This function only unmaps the page without recycling it, leading to memory leaks. After repeated operations of bringing the Ethernet interface up and down, the system can run out of memory, causing crashes or degraded performance. The issue was identified during extensive testing, where it was found that after approximately 391 cycles, the system would stall due to insufficient memory.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid frequent up and down operations on the Ethernet interface. If you need to test the interface, consider limiting the number of cycles to reduce the risk of memory exhaustion.
Conclusion
CVE-2023-52998 is a significant vulnerability in the Linux kernel's FEC driver that can lead to memory leaks and system instability. It is crucial to update to the patched version to ensure system stability and performance. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52998 is a vulnerability in the Linux kernel's FEC driver that can lead to memory leaks and system instability.
Repeatedly bringing the Ethernet interface up and down can exhaust system memory, leading to crashes or degraded performance.
Yes, the vulnerability has been patched in version 6.1.11-1 of the Linux package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, limit the number of times you bring the Ethernet interface up and down to mitigate the risk of memory exhaustion.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
