False Positive kmemleak Report in x86/pm
Summary
GSD-2022-1003629: x86/pm: Fix false positive kmemleak report in msr_build_context(). Affects Kernel versions >= 7a9c2dd08eadd5c6943115dbbec040c38d2e0822, < b6ecf2b7e691eed248290e3dfec22d3093c44e0c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The x86/pm package is a component of the Linux Kernel that handles power management for x86 architecture. It provides functionality for managing power states, CPU frequency scaling, and other power-related operations. The package is an integral part of the Linux Kernel and is widely used in various Linux distributions.
Vulnerability Detail
The vulnerability in x86/pm is related to a false positive kmemleak report in the msr_build_context() function. This function is responsible for building the context for accessing Model Specific Registers (MSRs) on x86 processors. Due to a coding error, the kmemleak tool incorrectly reports a memory leak in this function, even though there is no actual memory leak. This false positive report can lead to unnecessary investigation and potential waste of resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability as it is a false positive report. However, users can ignore the kmemleak report in msr_build_context() if they are aware of this issue and have confirmed that there is no actual memory leak. This can be done by configuring the kmemleak tool to exclude the msr_build_context() function from its analysis.
Conclusion
The false positive kmemleak report in x86/pm's msr_build_context() function can lead to unnecessary investigation and waste of resources. It has been fixed in Linux Kernel version v5.10.121. Users are advised to update their Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is minimal as it is a false positive report. However, it can lead to unnecessary investigation and waste of resources if not properly addressed.
This vulnerability was discovered through code analysis and testing, specifically using the kmemleak tool that detects memory leaks in the Linux Kernel.
No, only versions starting from v4.5 are affected. The vulnerability has been fixed in Linux Kernel version v5.10.121.
No, there is no known exploit for this vulnerability as it is a false positive report and does not represent an actual security issue.
No, this vulnerability cannot be exploited remotely as it is a false positive report and does not represent an actual security issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
