USBIP Refcount Leak in Linux Kernel
Summary
GSD-2022-1003540: usb: usbip: fix a refcount leak in stub_probe(). Affects Kernel versions >= 3ff67445750a84de67faaf52c6e1895cb09f2c56, < bcbb795a9e78180d74c6ab21518da87e803dfdce. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. USBIP is a kernel module that allows remote USB devices to be used as if they were connected locally. This vulnerability in the USBIP module can lead to a refcount leak, potentially causing resource exhaustion and denial of service.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1003540, exists in the stub_probe() function of the USBIP module. When a USB device is probed, the refcount is not properly handled, leading to a leak. An attacker could exploit this vulnerability by repeatedly probing USB devices, causing the refcount to increase and potentially exhausting system resources. This could result in a denial of service condition, impacting the availability of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The USBIP refcount leak vulnerability in the Linux Kernel can lead to resource exhaustion and denial of service. It is crucial to update the kernel to version v5.10.122 or later to mitigate this issue. No specific workaround has been provided. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource exhaustion and denial of service, potentially impacting the availability of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, no known exploits have been reported for this vulnerability. However, it is still important to apply the recommended fix to ensure the security and stability of your system.
Yes, this vulnerability can be exploited remotely. An attacker could send malicious requests to the USBIP module, causing the refcount to leak and potentially leading to a denial of service condition.
The recommended mitigation is to update the Linux Kernel to the latest version that includes the fix for this vulnerability. Additionally, it is always good practice to have proper network security measures in place to minimize the risk of remote exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
