Memory Leak in smsc75xx_bind in Kernel
Summary
GSD-2021-1000680: net: usb: fix memory leak in smsc75xx_bind. Affects Kernel versions >= d0cad871703b898a442e4049c532ec39168e5b57, < 9e6b8c1ff9d997e1fa16cbd2d60739adf6dc1bbc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as a bridge between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the stability and security of the system. The smsc75xx_bind function in the Kernel's USB network driver is responsible for binding a network interface to a USB device. However, a memory leak vulnerability has been identified in this function, which could lead to the exhaustion of system memory resources over time.
Vulnerability Detail
The memory leak vulnerability in smsc75xx_bind arises from a failure to release allocated memory when binding a network interface to a USB device. This can result in a gradual depletion of available memory, potentially leading to system instability or denial of service. An attacker with physical access to a vulnerable system could exploit this vulnerability to exhaust system resources, causing a system crash or rendering it unresponsive. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The memory leak vulnerability in smsc75xx_bind in the Kernel can lead to the gradual depletion of system memory, potentially causing system instability or denial of service. It is crucial to update the Linux Kernel to version v4.14.235 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could lead to the gradual depletion of system memory, potentially resulting in system instability or denial of service.
An attacker with physical access to a vulnerable system could exploit this vulnerability to exhaust system resources, causing a system crash or rendering it unresponsive.
There is no evidence of this vulnerability being actively exploited at this time.
The vulnerability was introduced in version v2.6.34 of the Linux Kernel and is present in all versions until v4.14.234.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2021-1000680.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
