Vulnerability in s390/zcrypt package: zcard and zqueue hot-unplug memleak
Summary
GSD-2021-1000083: s390/zcrypt: fix zcard and zqueue hot-unplug memleak. Affects Kernel versions >= 29c2680fd2bf3862ff5cf2957f198512493156f9, < 971dc8706cee47393d393905d294ea47e39503d3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The s390/zcrypt package is a component of the Linux Kernel that provides cryptographic support for IBM System z hardware. It includes drivers and interfaces for zcrypt cards and zcrypt queues, which are used for cryptographic operations. These components are crucial for secure communication and data protection on IBM System z systems.
Vulnerability Detail
The vulnerability in the s390/zcrypt package involves a memory leak issue when hot-unplugging zcrypt cards and zcrypt queues. This issue was introduced in version v5.10 of the Linux Kernel by commit 29c2680fd2bf3862ff5cf2957f198512493156f9 and was fixed in version v5.12.3 by commit 971dc8706cee47393d393905d294ea47e39503d3. The memory leak occurs when zcrypt cards or queues are hot-unplugged, leading to a gradual depletion of system memory over time. Although the impact and attack plausibility have not been proven, this vulnerability could potentially result in system instability and performance degradation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The s390/zcrypt package in the Linux Kernel is vulnerable to a memory leak issue when hot-unplugging zcrypt cards and zcrypt queues. This vulnerability can potentially lead to system instability and performance degradation. To mitigate the risk, it is advised to update the Linux Kernel to version v5.12.3 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The s390/zcrypt package is a component of the Linux Kernel that provides cryptographic support for IBM System z hardware. It includes drivers and interfaces for zcrypt cards and zcrypt queues, which are used for cryptographic operations.
The impact of this vulnerability is not yet proven, but it could potentially result in system instability and performance degradation due to the gradual depletion of system memory when hot-unplugging zcrypt cards or queues.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.12.3 or later. This can be done by obtaining the latest stable version of the Linux Kernel from the official repository and following the installation instructions provided.
No specific workaround has been mentioned for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
You can find more information about this vulnerability in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The vulnerability ID is GSD-2021-1000083.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
