Memory Leak Vulnerability in net: rds: fix memory leak in rds_recvmsg
Summary
GSD-2021-1000978: net: rds: fix memory leak in rds_recvmsg. Affects Kernel versions >= bdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb, < 5946fbf48355f5a8caeff72580c7658da5966b86. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package in the Linux Kernel is responsible for network communication and provides various protocols and functions for network operations. One of these protocols is the Reliable Datagram Sockets (RDS), which is used for reliable and high-performance communication between processes. However, a vulnerability has been discovered in the RDS implementation that can lead to a memory leak in the rds_recvmsg function.
Vulnerability Detail
The vulnerability in the rds_recvmsg function of the RDS protocol can result in a memory leak. When a malicious actor sends specially crafted messages to a vulnerable system, the rds_recvmsg function fails to release allocated memory, leading to a gradual depletion of system resources. This can eventually cause a denial-of-service condition or impact the overall performance of the system. The vulnerability was introduced in version v2.6.30 of the Linux Kernel and has been fixed in version v5.10.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch provided in the updated Linux Kernel to mitigate the memory leak issue.
Conclusion
The memory leak vulnerability in the rds_recvmsg function of the RDS protocol can have severe consequences, including a denial-of-service condition and performance degradation. It is crucial to update the Linux Kernel to version v5.10.46 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, causing a gradual depletion of system resources. This can result in a denial-of-service condition or affect the overall performance of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this memory leak vulnerability.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the patch provided in the updated Linux Kernel to prevent any potential exploitation.
Yes, this vulnerability can be remotely exploited by sending specially crafted messages to a vulnerable system.
The only known mitigation for this vulnerability is to update the Linux Kernel to version v5.10.46 or later. It is recommended to apply the patch provided by the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
