Memory Leak in smsc75xx_bind in Kernel
Summary
GSD-2021-1000606: net: usb: fix memory leak in smsc75xx_bind. Affects Kernel versions >= d0cad871703b898a442e4049c532ec39168e5b57, < 635ac38b36255d3cfb8312cf7c471334f4d537e0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The smsc75xx_bind function in the Kernel is responsible for binding the smsc75xx USB network driver to the USB device. This driver is commonly used for USB Ethernet adapters. However, a memory leak vulnerability has been discovered in the smsc75xx_bind function, which could lead to memory exhaustion and potential system instability.
Vulnerability Detail
The vulnerability in smsc75xx_bind arises from a memory leak issue. When the function is called to bind the smsc75xx USB network driver to a USB device, it fails to release allocated memory in certain scenarios. This can result in a continuous accumulation of memory over time, leading to memory exhaustion and potential system crashes. An attacker with physical access to the affected system could exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by unbinding and re-binding the smsc75xx USB network driver manually. This can be achieved by executing the following commands as root:
- Find the USB device ID of the smsc75xx driver using the 'lsusb' command.
- Unbind the driver from the USB device using the 'echo -n <device_id> > /sys/bus/usb/drivers/smsc75xx/unbind' command.
- Rebind the driver to the USB device using the 'echo -n <device_id> > /sys/bus/usb/drivers/smsc75xx/bind' command.
Please note that this workaround is temporary and should be followed by updating the Kernel as soon as possible.
Conclusion
The memory leak vulnerability in smsc75xx_bind in the Kernel can lead to memory exhaustion and potential system crashes. It is crucial to update the Linux Kernel to version v5.10.42 or later to mitigate this vulnerability. In the meantime, a temporary workaround can be applied by manually unbinding and re-binding the smsc75xx USB network driver. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory exhaustion and potential system crashes, resulting in a denial-of-service (DoS) condition. It could also potentially allow an attacker to execute arbitrary code with elevated privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
Yes, a fix is available in Linux Kernel version v5.10.42 and later. It is recommended to update the Kernel to address this vulnerability.
Yes, a temporary workaround involves manually unbinding and re-binding the smsc75xx USB network driver. Instructions for this workaround are provided in the 'workaround' section above.
The updated Linux Kernel can be obtained from the official Linux Kernel repository or through your Linux distribution's package manager. Please refer to the official documentation or support channels for your specific distribution for detailed instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
