Memory Leak in cfusbl_device_notify in Kernel
Summary
GSD-2021-1000722: net: caif: fix memory leak in cfusbl_device_notify. Affects Kernel versions >= 7ad65bf68d705b445ef10b77ab50dab22be185ee, < 81afc61cb6e2b553f2c5f992fa79e0ae73857141. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The cfusbl_device_notify function in the Kernel's caif subsystem is responsible for handling notifications related to USB devices. However, a memory leak vulnerability has been identified in this function.
Vulnerability Detail
The memory leak vulnerability in cfusbl_device_notify allows an attacker to consume excessive memory resources by repeatedly triggering USB device notifications. This can lead to a denial-of-service (DoS) condition, causing system instability or even crashing the system. The vulnerability was introduced in version v3.3 of the Linux Kernel and was fixed in version v4.9.272. The specific commit that addressed this issue is 81afc61cb6e2b553f2c5f992fa79e0ae73857141.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.9.272 or later. This can be done by obtaining the latest stable version of the Kernel from the official Git repository and applying the necessary updates. Alternatively, users can wait for their Linux distribution to release an updated package containing the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Linux Kernel to a patched version.
Conclusion
The memory leak vulnerability in cfusbl_device_notify in the Kernel can be exploited to consume excessive memory resources, leading to a denial-of-service condition. It is crucial to update the Linux Kernel to version v4.9.272 or later to mitigate this vulnerability. If you are unsure whether your system is affected, you can use Vulert's playground at https://vulert.com/scanner to check for open-source vulnerabilities. For additional support, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition, causing system instability or crashing the system.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities.
No, this vulnerability requires local access to the system to trigger USB device notifications and exploit the memory leak.
There are no known instances of this vulnerability being exploited in the wild.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.