Memory Leak Vulnerability in mcba_usb
Summary
GSD-2021-1000929: can: mcba_usb: fix memory leak in mcba_usb. Affects Kernel versions >= 51f3baad7de943780ce0c17bd7975df567dd6e14, < 6f87c0e21ad20dd3d22108e33db1c552dfa352a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mcba_usb is a module in the Linux Kernel that provides support for the MCBA USB CAN interface. It allows users to connect and communicate with CAN (Controller Area Network) devices via USB. The module is an essential component for applications that require CAN functionality on Linux systems.
Vulnerability Detail
The mcba_usb module in the Linux Kernel prior to version v5.4.128 suffers from a memory leak vulnerability. This vulnerability was introduced in version v4.12 and fixed in version v5.4.128. The vulnerability occurs when the module fails to release allocated memory, leading to a continuous consumption of memory resources. An attacker could exploit this vulnerability by repeatedly triggering the memory allocation process, causing the system to run out of memory and potentially resulting in a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can unload the mcba_usb module and reload it periodically to release the accumulated memory. This can be achieved using the following commands:
-
Unload the mcba_usb module: $ sudo rmmod mcba_usb
-
Reload the mcba_usb module: $ sudo modprobe mcba_usb
Conclusion
The memory leak vulnerability in the mcba_usb module of the Linux Kernel can potentially lead to a denial-of-service (DoS) condition. It is recommended to update the kernel to version v5.4.128 or later to mitigate this vulnerability. Alternatively, users can follow the provided workaround to periodically release the accumulated memory. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mcba_usb is a module in the Linux Kernel that provides support for the MCBA USB CAN interface. It enables communication with CAN devices via USB.
A memory leak vulnerability occurs when a program or module fails to release allocated memory, leading to a continuous consumption of memory resources.
The impact of this vulnerability is not yet proven. However, it could potentially result in a denial-of-service (DoS) condition if an attacker repeatedly triggers the memory allocation process, causing the system to run out of memory.
To fix this vulnerability, update the Linux Kernel to version v5.4.128 or later, which includes the necessary fix for the mcba_usb memory leak issue.
Yes, as a workaround, users can periodically unload and reload the mcba_usb module to release the accumulated memory. Refer to the provided workaround section for detailed instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
