Memory Leak in mt7615_coredump_work in Kernel
Summary
GSD-2021-1000252: mt76: mt7615: fix memory leak in mt7615_coredump_work. Affects Kernel versions >= d2bf7959d9c0f631ef860edaf834d55773fdedff, < 54b989653c5531bc4416ced33f146b9cb633d978. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that provides core functionalities and acts as a bridge between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The mt7615_coredump_work is a specific function within the Kernel's mt76 module that handles the generation of coredump data for the MediaTek MT7615 wireless chipset. This coredump data is crucial for debugging and troubleshooting wireless connectivity issues. However, a memory leak vulnerability has been identified in the mt7615_coredump_work function, which can lead to the exhaustion of system memory resources over time.
Vulnerability Detail
The memory leak vulnerability in mt7615_coredump_work arises due to improper memory management within the function. When the mt7615_coredump_work function is invoked, it fails to release allocated memory properly, resulting in a gradual accumulation of unreleased memory blocks. As a consequence, the system's available memory diminishes over time, potentially leading to performance degradation, system instability, and even denial-of-service conditions. Exploiting this vulnerability may require an attacker to repeatedly trigger the mt7615_coredump_work function, causing a significant impact on system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the generation of coredump data for the MediaTek MT7615 wireless chipset. This can be achieved by modifying the Kernel configuration or module parameters to exclude the mt7615_coredump_work function. However, it is important to note that disabling coredump generation may hinder the ability to diagnose wireless connectivity issues effectively.
Conclusion
The memory leak vulnerability in mt7615_coredump_work within the Kernel can lead to the gradual exhaustion of system memory resources, potentially causing performance issues and system instability. It is crucial to update the Linux Kernel to version v5.12.4 or later to fix this vulnerability. Alternatively, users can apply the provided workaround of disabling coredump generation for the MediaTek MT7615 wireless chipset. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a gradual exhaustion of system memory resources, potentially causing performance degradation, system instability, and denial-of-service conditions.
An attacker may repeatedly trigger the mt7615_coredump_work function to exploit the memory leak vulnerability and consume system memory, leading to resource exhaustion and potential system disruption.
At the time of this report, there is no known public exploit available for this vulnerability. However, it is advisable to apply the recommended fix or workaround to mitigate the risk.
This vulnerability requires an attacker to have local access to the system in order to trigger the mt7615_coredump_work function. Therefore, remote exploitation is unlikely unless the attacker has already gained unauthorized access to the target system.
The primary solution to mitigate this vulnerability is to update the Linux Kernel to the recommended version. However, if updating is not immediately feasible, users can employ the provided workaround of disabling coredump generation for the MediaTek MT7615 wireless chipset.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
