Memory Leak in dmi-sysfs in Kernel
Summary
GSD-2022-1003972: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle. Affects Kernel versions >= 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181, < ed38d04342dfbe9e5aca745c8b5eb4188a74f0ef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dmi-sysfs is a firmware component in the Linux Kernel that provides a sysfs interface to access the Desktop Management Interface (DMI) data. DMI is a standard for describing hardware components of a computer system. The dmi-sysfs allows users to retrieve information about the system's hardware configuration. However, a memory leak vulnerability has been discovered in the dmi_sysfs_register_handle function.
Vulnerability Detail
The memory leak vulnerability in dmi-sysfs arises from a failure to release allocated memory when registering a new DMI handle. This can result in a gradual depletion of system memory resources, leading to performance degradation or even system instability. An attacker may be able to exploit this vulnerability to exhaust system memory and cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version 2.6.39 and is fixed in version 4.14.283.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can unload the dmi-sysfs module to prevent the vulnerable code from being executed. This can be done by running the following command as root:
rmmod dmi-sysfs
However, this workaround will disable access to DMI data via sysfs until the module is reloaded or the system is rebooted.
Conclusion
The memory leak vulnerability in dmi-sysfs can have serious consequences on system performance and stability. It is crucial to update the Linux Kernel to the fixed version or apply the temporary workaround to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dmi-sysfs is a firmware component in the Linux Kernel that provides a sysfs interface to access the Desktop Management Interface (DMI) data. DMI is a standard for describing hardware components of a computer system.
The memory leak vulnerability in dmi-sysfs can result in a gradual depletion of system memory resources, leading to performance degradation or even system instability. An attacker may be able to exploit this vulnerability to exhaust system memory and cause a denial-of-service condition.
To fix this vulnerability, it is recommended to update the Linux Kernel to version 4.14.283 or later. Users can download the updated kernel source code from the official Linux Kernel repository and compile it for their system. Alternatively, they can wait for their Linux distribution to provide an updated package containing the fixed kernel version.
Yes, as a temporary workaround, users can unload the dmi-sysfs module to prevent the vulnerable code from being executed. This can be done by running the command 'rmmod dmi-sysfs' as root. However, this workaround will disable access to DMI data via sysfs until the module is reloaded or the system is rebooted.
This vulnerability was introduced in Linux Kernel version 2.6.39 and fixed in version 4.14.283.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
