Memory Leak Vulnerability in crypto: sun8i-ss
Summary
GSD-2021-1000297: crypto: sun8i-ss - fix result memory leak on error path. Affects Kernel versions >= d9b45418a91773b7672e4c60037a28074b495c6d, < 50e7b39b808430ad49a637dc6fb72ca93b451b13. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The crypto: sun8i-ss package is a component of the Linux Kernel, specifically designed for the sun8i-ss cryptographic engine found in Allwinner SoCs. This engine provides hardware acceleration for various cryptographic operations, enhancing performance and security. However, a memory leak vulnerability has been identified in this package, which could lead to resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The memory leak vulnerability in crypto: sun8i-ss occurs when an error path is encountered during cryptographic operations. In such cases, the result memory is not properly freed, leading to a gradual depletion of available memory resources. An attacker could potentially exploit this vulnerability by repeatedly triggering the error path, causing the system to run out of memory and become unresponsive. This could result in a denial-of-service condition, impacting the availability of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the fix by updating the Linux Kernel to the recommended version.
Conclusion
The memory leak vulnerability in crypto: sun8i-ss can lead to resource exhaustion and denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.12.4 or later to mitigate this vulnerability. No known exploits exist at the moment, but it is still recommended to apply the fix as a proactive security measure. For additional support, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and denial-of-service attacks, potentially rendering the affected system unresponsive.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known exploits for this vulnerability. However, it is still important to apply the recommended fix to mitigate any potential risks.
No, this vulnerability requires the attacker to have local access to the system in order to trigger the error path and exploit the memory leak.
For further support and assistance in addressing this vulnerability, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
