Memory Leak Vulnerability in Linux Kernel
Summary
GSD-2022-1003073: media: rga: fix possible memory leak in rga_probe. Affects Kernel versions < b7bbca4d08471bc8404a946bab1aa017dd05199b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is a critical piece of software that is widely used in various devices, including servers, desktops, and embedded systems. The vulnerability identified in this report relates to the media subsystem of the Linux Kernel, specifically the rga module. The rga module is responsible for handling graphics acceleration on certain hardware platforms. A memory leak vulnerability has been discovered in the rga_probe function, which could potentially lead to resource exhaustion and system instability.
Vulnerability Detail
The memory leak vulnerability in the rga_probe function of the Linux Kernel's media subsystem can be exploited by an attacker to exhaust system resources and potentially cause a denial-of-service condition. The vulnerability arises from a failure to properly release allocated memory in certain error scenarios. By repeatedly triggering these error conditions, an attacker could gradually consume all available memory, leading to system instability or even a complete system crash. This vulnerability has been assigned the ID GSD-2022-1003073 and has been fixed in Linux Kernel version v5.17.14 by commit b7bbca4d08471bc8404a946bab1aa017dd05199b.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented to mitigate the risk of exploitation. One possible workaround is to disable the rga module by blacklisting it. This can be achieved by adding the following line to the '/etc/modprobe.d/blacklist.conf' file:
blacklist rga
After adding this line, reboot the system for the changes to take effect. It is important to note that this workaround may impact the functionality of graphics acceleration on affected hardware platforms.
Conclusion
In conclusion, a memory leak vulnerability has been identified in the rga_probe function of the Linux Kernel's media subsystem. This vulnerability can be exploited to exhaust system resources and potentially cause a denial-of-service condition. It is crucial to update the Linux Kernel to version v5.17.14 or later to fix this vulnerability. Alternatively, a temporary workaround of blacklisting the rga module can be implemented. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and system instability, potentially resulting in a denial-of-service condition. It could also be leveraged as part of a larger attack chain to compromise the system's security.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any known vulnerabilities are present.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk of potential exploits.
This vulnerability requires local access to the system to trigger the memory leak. However, if an attacker already has local access, they could potentially exploit this vulnerability to disrupt system operations or facilitate further attacks.
The primary solution to mitigate this vulnerability is to update the Linux Kernel to the fixed version. However, if updating the kernel is not immediately feasible, the temporary workaround of blacklisting the rga module can be implemented to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
