Memory Leak Vulnerability in firmware: dmi-sysfs
Summary
GSD-2022-1002987: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle. Affects Kernel versions >= 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181, < 3ba359ebe914ac3f8c6c832b28007c14c39d3766. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The firmware package 'dmi-sysfs' is a component of the Linux Kernel ecosystem. It provides functionality for registering and handling Direct Memory Access (DMA) devices. DMA devices allow data to be transferred between system memory and peripheral devices without involving the CPU. The 'dmi-sysfs' package is vulnerable to a memory leak issue, which can lead to the exhaustion of system resources and potential instability.
Vulnerability Detail
The memory leak vulnerability in 'dmi-sysfs' occurs when registering a handle. This vulnerability was introduced in version v2.6.39 of the Linux Kernel and has been present until version v5.17.15. The vulnerability allows an attacker to repeatedly register handles without releasing the associated memory, leading to a gradual depletion of system resources. If exploited, this can result in system instability, crashes, or denial of service (DoS) conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually release the memory associated with the handles after they are no longer needed. This can be done by modifying the code that registers the handles to include a release mechanism. Here is an example in C:
void register_handle() {
// Code to register the handle
...
// Code to release the handle
...
}
Conclusion
In conclusion, the 'dmi-sysfs' firmware package in the Linux Kernel is vulnerable to a memory leak issue. This vulnerability can lead to the gradual depletion of system resources and potential instability. It is crucial to update the Kernel to version v5.17.15 or later to fix this vulnerability. Additionally, users can manually release the memory associated with the handles as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to the gradual depletion of system resources, potentially causing system instability, crashes, or denial of service (DoS) conditions.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this memory leak issue.
Yes, the vulnerability has been fixed in Linux Kernel version v5.17.15. It is recommended to update your Kernel to this version or later to ensure the memory leak issue is resolved.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security patches and updates promptly to mitigate any potential risks.
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com. Our team will be happy to help you address any concerns or questions you may have.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
