False Positive kmemleak Report in x86/pm
Summary
GSD-2022-1003808: x86/pm: Fix false positive kmemleak report in msr_build_context(). Affects Kernel versions >= 7a9c2dd08eadd5c6943115dbbec040c38d2e0822, < 1d0c4bc628ca2a2f2f41130dfc852efc065d555c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The x86/pm package is a component of the Linux Kernel, which is responsible for managing power management features on x86-based systems. It provides functionality related to CPU power management, including handling of MSR (Model Specific Register) contexts. The package is widely used in Linux distributions and is critical for the proper functioning of power management on x86 systems.
Vulnerability Detail
The vulnerability identified as GSD-2022-1003808 in the x86/pm package involves a false positive kmemleak report in the msr_build_context() function. This function is responsible for building the MSR context, which is used for managing Model Specific Registers. Due to a coding error, the kmemleak tool incorrectly reports a memory leak in this function, leading to false positive warnings. While this issue does not pose a direct security risk, it can cause confusion and unnecessary concern for developers and users relying on kmemleak reports.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this issue as it is a false positive report generated by the kmemleak tool. However, developers and users can ignore the false positive warning until they update their Linux Kernel to a version that includes the fix.
Conclusion
In conclusion, the false positive kmemleak report in the x86/pm package can cause confusion and unnecessary concern for developers and users relying on kmemleak reports. It is recommended to update the Linux Kernel to a version that includes the fix commit 1d0c4bc628ca2a2f2f41130dfc852efc065d555c to resolve this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability does not pose a direct security risk but can cause confusion and unnecessary concern for developers and users relying on kmemleak reports.
To fix this vulnerability, update your Linux Kernel to a version that includes the fix commit 1d0c4bc628ca2a2f2f41130dfc852efc065d555c.
There is no specific workaround for this issue as it is a false positive report. However, you can ignore the false positive warning until you update your Linux Kernel.
The vulnerability was introduced in version v4.5 by commit 7a9c2dd08eadd5c6943115dbbec040c38d2e0822 and is fixed in version v5.4.198 by commit 1d0c4bc628ca2a2f2f41130dfc852efc065d555c.
You can find more information about this vulnerability in the GSD-2022-1003808 JSON file available in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003808.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
