USB: usbfs: Don't WARN about excessively large memory allocations
Summary
GSD-2021-1000641: USB: usbfs: Don't WARN about excessively large memory allocations. Affects Kernel versions < 2c835fede13e03f2743a333e4370b5ed2db91e83. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for software to interact with the hardware. The usbfs subsystem in the Kernel is responsible for handling USB devices connected to the system. This vulnerability specifically relates to the handling of memory allocations within usbfs.
Vulnerability Detail
The vulnerability in usbfs involves a warning mechanism that triggers when excessively large memory allocations are requested. This warning can potentially be exploited by an attacker to cause a denial-of-service (DoS) condition on the system. By repeatedly requesting large memory allocations, an attacker could exhaust system resources, leading to system instability or crashes. The vulnerability has been fixed in Linux Kernel version v5.4.124 by commit 2c835fede13e03f2743a333e4370b5ed2db91e83.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The USB: usbfs vulnerability in the Kernel package can be exploited to cause a denial-of-service (DoS) condition on the system. It is crucial to update the Kernel to version v5.4.124 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can be exploited to cause a denial-of-service (DoS) condition on the system, potentially leading to system instability or crashes.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
There is no known exploit for this vulnerability at the moment. However, it is still important to apply the necessary updates to mitigate the risk.
The vulnerability was introduced in an earlier version of the Kernel and has been fixed in version v5.4.124. It is recommended to update to this version or later to ensure the vulnerability is patched.
For more details about this vulnerability, you can refer to the source link provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
