Memory Leak in cfusbl_device_notify in Kernel
Summary
GSD-2021-1000774: net: caif: fix memory leak in cfusbl_device_notify. Affects Kernel versions >= 7ad65bf68d705b445ef10b77ab50dab22be185ee, < 46403c1f80b0d3f937ff9c4f5edc63bb64bc5051. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The cfusbl_device_notify function in the Kernel's net/caif/usb.c file is responsible for handling notifications related to USB devices in the CAIF (Common Air Interface) subsystem. However, a memory leak vulnerability has been identified in this function.
Vulnerability Detail
The memory leak vulnerability in cfusbl_device_notify arises from a failure to release allocated memory under certain conditions. This can result in a gradual accumulation of unreleased memory, leading to memory exhaustion and potential system instability. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v5.10.43.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.43 or later. This update includes the commit 46403c1f80b0d3f937ff9c4f5edc63bb64bc5051, which addresses the memory leak issue in cfusbl_device_notify. Updating the Kernel ensures that the fix is applied and eliminates the vulnerability from the system.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the memory leak issue by refraining from using USB devices in the CAIF subsystem until the Kernel is updated to a version that includes the fix.
Conclusion
In conclusion, a memory leak vulnerability has been identified in the cfusbl_device_notify function in the Kernel's net/caif/usb.c file. This vulnerability can lead to memory exhaustion, system instability, and potential unauthorized code execution. It is crucial to update the Linux Kernel to version v5.10.43 or later to apply the fix and eliminate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory exhaustion and potential system instability. It may also allow an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in version v5.10.43 of the Linux Kernel. It is recommended to update the Kernel to this version or a later one to apply the fix.
While updating the Kernel is the recommended approach, you can mitigate the risk by avoiding the use of USB devices in the CAIF subsystem until the Kernel is updated with the fix.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the fix as soon as possible to eliminate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.