Memory Leak in ip_mc_add1_src in Linux Kernel
Summary
GSD-2021-1000923: net: ipv4: fix memory leak in ip_mc_add1_src. Affects Kernel versions >= 24803f38a5c0b6c57ed800b47e695f9ce474bc3a, < 3dd2aeac2e9624cff9fa634710837e4f2e352758. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionality. It is a critical part of the Linux ecosystem and is widely used in various devices and systems. The ip_mc_add1_src function in the IPv4 networking stack of the Linux Kernel is vulnerable to a memory leak. This function is responsible for adding a multicast source to a multicast group. The vulnerability can lead to a gradual depletion of system memory, potentially causing performance degradation or even system instability.
Vulnerability Detail
The vulnerability in ip_mc_add1_src arises from a memory leak issue. When adding a multicast source to a multicast group, the function fails to release allocated memory in certain scenarios. This can result in a gradual accumulation of memory over time, leading to memory exhaustion. An attacker could potentially exploit this vulnerability by repeatedly adding multicast sources, causing a denial-of-service condition or system instability. The impact of this vulnerability depends on the specific usage scenario and the availability of system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to a version that includes the necessary patch.
Conclusion
The memory leak vulnerability in ip_mc_add1_src in the Linux Kernel can lead to memory exhaustion and potential system instability. It is crucial to update the Linux Kernel to a version that includes the necessary fix. Regularly updating the Linux Kernel helps ensure the latest security patches and bug fixes are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific usage scenario and the availability of system resources. It can potentially lead to memory exhaustion, causing performance degradation or system instability.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the necessary patches and updates to mitigate the risk.
The vulnerability was introduced in Linux Kernel version v4.9 by commit 24803f38a5c0b6c57ed800b47e695f9ce474bc3a. It is fixed in version v5.4.128 by commit 3dd2aeac2e9624cff9fa634710837e4f2e352758. Versions within this range may be affected.
If you are unable to update the Linux Kernel immediately, it is recommended to monitor your system for any abnormal behavior or performance degradation. Implement additional security measures and prioritize the update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
