Memory Leak in smsc75xx_bind in Kernel
Summary
GSD-2021-1000639: net: usb: fix memory leak in smsc75xx_bind. Affects Kernel versions >= d0cad871703b898a442e4049c532ec39168e5b57, < b95fb96e6339e34694dd578fb6bde3575b01af17. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces between hardware and software. It manages system resources, including memory, processes, and device drivers. The smsc75xx_bind function in the USB subsystem of the Kernel is responsible for binding the SMSC75xx USB Ethernet driver to the USB device. This driver enables communication with SMSC75xx USB Ethernet adapters. However, a memory leak vulnerability has been identified in the smsc75xx_bind function, which could lead to the exhaustion of system memory resources over time.
Vulnerability Detail
The memory leak vulnerability in smsc75xx_bind arises due to improper handling of memory allocation and deallocation. When a USB Ethernet adapter using the SMSC75xx driver is bound to the system, memory is allocated for various data structures. However, if the binding process fails or encounters an error, the allocated memory is not properly freed, resulting in a memory leak. Over time, this can lead to the depletion of available memory, potentially causing system instability or denial of service conditions. The vulnerability was introduced in version v2.6.34 of the Kernel and has been fixed in version v5.4.124.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can unload and reload the SMSC75xx USB Ethernet driver module after each use to free up the allocated memory. This can be done using the following commands:
$ sudo modprobe -r smsc75xx
$ sudo modprobe smsc75xx
However, this workaround is not a permanent solution and may impact the usability and performance of the USB Ethernet adapter.
Conclusion
The memory leak vulnerability in smsc75xx_bind can pose a risk to the stability and performance of systems running the affected Kernel versions. It is crucial to update the Kernel to version v5.4.124 or later to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability in smsc75xx_bind can lead to the depletion of system memory resources over time. This can result in system instability, performance degradation, or denial of service conditions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this memory leak vulnerability in smsc75xx_bind.
Yes, the memory leak vulnerability in smsc75xx_bind has been fixed in Linux Kernel version v5.4.124. It is recommended to update your Kernel to this version or later to mitigate the vulnerability.
As a temporary measure, you can unload and reload the SMSC75xx USB Ethernet driver module after each use to free up the allocated memory. However, this is not a permanent solution and may have usability and performance implications.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. Visit the following link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000639.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
