Memory Leak in cfusbl_device_notify in Kernel
Summary
GSD-2021-1000739: net: caif: fix memory leak in cfusbl_device_notify. Affects Kernel versions >= 7ad65bf68d705b445ef10b77ab50dab22be185ee, < 9ea0ab48e755d8f29fe89eb235fb86176fdb597f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as a bridge between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the stability and security of the system. The cfusbl_device_notify function in the Kernel's caif (CAIF USB Link) module is responsible for handling notifications related to USB devices. However, a memory leak vulnerability has been identified in this function, which could lead to resource exhaustion and potential system instability.
Vulnerability Detail
The memory leak vulnerability in cfusbl_device_notify arises from a failure to properly release allocated memory when handling USB device notifications. This can result in a gradual depletion of available memory resources, leading to performance degradation and, in extreme cases, system crashes. An attacker with local access to the affected system could potentially exploit this vulnerability to exhaust system resources, causing a denial-of-service (DoS) condition. The vulnerability was introduced in Kernel version v3.3 and has been fixed in version v4.19.194.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the caif module in the Kernel configuration if it is not required for their specific use case. This can be achieved by modifying the Kernel configuration file and removing the corresponding caif configuration option. However, this workaround should only be considered if the caif module is not essential for system functionality, as it may impact certain USB-related features.
Conclusion
The memory leak vulnerability in cfusbl_device_notify in the Kernel can lead to resource exhaustion and potential system instability. It is crucial to update the Kernel to version v4.19.194 or later to fix this vulnerability. Alternatively, users can disable the caif module if it is not necessary for their system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a gradual depletion of available memory resources, potentially causing performance degradation and system crashes. An attacker with local access to the system could exploit this vulnerability to trigger a denial-of-service (DoS) condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the Vulert Playground will analyze it for any open-source vulnerabilities, including this memory leak issue.
Yes, a patch for this vulnerability has been included in Kernel version v4.19.194. It is recommended to update your Kernel to this version or later to mitigate the memory leak issue.
While updating the Kernel is the recommended approach, you can also mitigate this vulnerability by disabling the caif module in the Kernel configuration if it is not necessary for your system. However, this workaround should only be considered if the caif module is not essential, as it may impact certain USB-related features.
You can find more information about this vulnerability in the GSD-2021-1000739 JSON report available on the Cloud Security Alliance's GSD Database GitHub repository (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000739.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
