False Positive kmemleak Report in x86/pm
Summary
GSD-2022-1003136: x86/pm: Fix false positive kmemleak report in msr_build_context(). Affects Kernel versions >= 7a9c2dd08eadd5c6943115dbbec040c38d2e0822, < 74a0b6c010da2fdfe610ad0fdf355914beaf3870. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The x86/pm package is a component of the Linux Kernel, which is responsible for power management on x86-based systems. It provides functionality for managing processor states, including performance and power-saving features. The package is an integral part of the Linux Kernel and is widely used in various Linux distributions and systems. However, a vulnerability has been identified in the package that leads to false positive kmemleak reports in the msr_build_context() function.
Vulnerability Detail
The vulnerability in x86/pm arises from a false positive kmemleak report in the msr_build_context() function. This issue was introduced in version v4.5 of the Linux Kernel and has been present until version v5.17.14. The false positive kmemleak report can potentially mislead developers and security analysts, causing them to overlook genuine memory leaks or waste time investigating false positives. While the impact and attack plausibility of this vulnerability have not been proven, it is essential to address it to ensure accurate memory leak detection.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The false positive kmemleak report vulnerability in x86/pm can potentially mislead developers and security analysts. It is crucial to update the Linux Kernel to version v5.17.14 or later to resolve this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The x86/pm package is a component of the Linux Kernel that handles power management on x86-based systems.
The impact of this vulnerability is the generation of false positive kmemleak reports, potentially leading to the oversight of genuine memory leaks or wasted investigation efforts.
To fix this vulnerability, update the Linux Kernel to version v5.17.14 or later, which includes the necessary fix for the false positive kmemleak report.
No, there is no known workaround for this vulnerability. Updating the Linux Kernel is the recommended solution.
For more information about this vulnerability, refer to the provided references and the source link in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
