Memory Leak in x86/MCE/AMD Kernel
Summary
GSD-2022-1002858: x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails. Affects Kernel versions >= 6458de97fc15530b54477c4e2b70af653e8ac3d9, < 396b8e7ab2a99ddac57d3522b3da5e58cb608d37. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system that serves as the foundation for various Linux distributions. It provides essential functionality and manages hardware resources. The x86/MCE/AMD component within the Kernel is responsible for handling Machine Check Exceptions (MCE) on AMD processors. MCEs are hardware errors that occur when the CPU detects a problem with its internal state or external environment. The x86/MCE/AMD module is vulnerable to a memory leak issue when the threshold_create_bank() function fails.
Vulnerability Detail
The vulnerability arises from a memory leak in the x86/MCE/AMD module when the threshold_create_bank() function fails. This can occur due to various reasons, such as insufficient memory allocation or invalid input parameters. When the function fails, it does not properly release the allocated memory, leading to a memory leak. An attacker could potentially exploit this vulnerability to exhaust system resources, causing denial-of-service conditions or other adverse effects. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The x86/MCE/AMD module in the Linux Kernel is vulnerable to a memory leak issue when the threshold_create_bank() function fails. This vulnerability can potentially lead to denial-of-service conditions or other adverse effects. It is recommended to update the Linux Kernel to version v5.18.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, it could potentially lead to denial-of-service conditions or other adverse effects by exhausting system resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the vulnerability has been fixed in Linux Kernel version v5.18.3. Users should update their Kernel to this version or later to mitigate the vulnerability.
The remote exploitability of this vulnerability has not been determined yet. Further analysis is required to assess the potential remote attack vectors.
There are no known instances of this vulnerability being exploited at the time of this report. However, it is advisable to apply the fix to ensure system security.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
