Memory Leak Vulnerability in Linux Kernel - Debian Packages
Summary
CVE-2021-47671: In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path In es58x_rx_err_msg(), if can->do_set_mode() fails, the function directly returns wit... Affects linux versions < 5.15.3-1. Fixed in 5.15.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device management, and system calls. This vulnerability specifically affects the Linux kernel in Debian versions 12 and 13, where a memory leak can occur under certain error conditions in the CAN (Controller Area Network) subsystem.
Vulnerability Detail
In the Linux kernel, specifically within the CAN subsystem, a vulnerability was identified in the es58x_rx_err_msg() function. If the can->do_set_mode() call fails, the function exits prematurely without freeing the previously allocated socket buffer (skb) created by alloc_can_err_skb(). This oversight leads to a memory leak, which can degrade system performance over time and potentially exhaust system memory resources. The issue was discovered using GCC's -fanalyzer tool, highlighting the importance of thorough code analysis in identifying such vulnerabilities.
How To Fix
Minimum fixed version
5.15.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability other than applying the patch. It is advisable to monitor the system for unusual memory usage until the update can be applied.
Conclusion
The CVE-2021-47671 vulnerability in the Linux kernel poses a significant risk due to a memory leak in the CAN subsystem. It is crucial for users of Debian versions 12 and 13 to update to the patched version 5.15.3-1 to ensure system stability and performance. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47671 is a vulnerability in the Linux kernel that causes a memory leak in the CAN subsystem when an error occurs during mode setting.
This vulnerability can lead to increased memory usage over time, potentially causing system slowdowns or crashes if not addressed.
Yes, Debian versions 12 and 13 are affected by this vulnerability. It is important to update to the fixed version to mitigate risks.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, monitor your system for unusual memory usage and plan to apply the update as soon as possible to prevent potential issues.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
