Memory Leak Vulnerability in Linux Kernel: SUNRPC RPC-over-TCP
Summary
DEBIAN-CVE-2024-35882: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a fe... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and network communication. The kernel's SUNRPC (Sun Remote Procedure Call) implementation facilitates communication between clients and servers over network protocols, including TCP. This vulnerability affects the memory management aspect of the SUNRPC, leading to potential memory exhaustion in NFS servers.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SUNRPC implementation, specifically related to RPC-over-TCP. The issue arises from a faulty assumption in a commit that sock_sendmsg() would release all pages in the underlying bio_vec array. However, it fails to release the record marker page fragment, leading to a slow memory leak on the server side. This can result in memory exhaustion for small NFS servers after a few days of operation, potentially causing service disruptions and degraded performance.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, administrators can monitor the memory usage of their NFS servers and restart the services periodically to mitigate the effects of the memory leak until the patch is applied.
Conclusion
The identified memory leak vulnerability in the Linux kernel's SUNRPC implementation poses a significant risk to NFS servers, leading to potential memory exhaustion. It is crucial for users to update to the patched version to mitigate this risk effectively. Regular monitoring and maintenance are also recommended until the fix is applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory exhaustion in NFS servers, potentially causing service disruptions and degraded performance.
You can use the Vulert playground to check if your application is affected by this vulnerability without requiring access to the code or installation.
The vulnerability affects the Linux packages in Debian 13 and 14 prior to version 6.8.9-1.
Yes, updating to the patched version 6.8.9-1 resolves the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
