Refcount Leak Bug in time.c - Linux Kernel
Summary
GSD-2022-1004250: xtensa: Fix refcount leak bug in time.c. Affects Kernel versions < 0e403a383c14b63c86bd9df085b7e573e9caee64. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, including memory, processes, and device drivers. The time.c file in the kernel is responsible for handling time-related operations and maintaining accurate system time. However, a vulnerability has been discovered in the time.c file that leads to a refcount leak.
Vulnerability Detail
The refcount leak bug in time.c allows for the improper handling of reference counts, leading to a resource leak. This vulnerability can be exploited by an attacker to exhaust system resources, potentially resulting in denial of service (DoS) conditions. The bug originates from a coding error in the time.c file, which fails to properly decrement the reference count when releasing resources. As a result, the reference count remains incremented, causing a leak of system resources over time. This vulnerability has been assigned the ID GSD-2022-1004250 and is fixed in Linux Kernel version v5.18.8 by commit 0e403a383c14b63c86bd9df085b7e573e9caee64.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability is fixed in Linux Kernel version v5.18.8, there is no specific workaround available. It is advised to update to the fixed version as soon as possible.
Conclusion
The refcount leak bug in time.c of the Linux Kernel can lead to resource leaks and potential denial of service (DoS) conditions. It is crucial to update to Linux Kernel version v5.18.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource leaks and potential denial of service (DoS) conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
Yes, the vulnerability is fixed in Linux Kernel version v5.18.8. It is recommended to update to this version or a later one.
The vulnerability itself does not provide remote exploitation capabilities. However, if an attacker can gain access to the affected system, they can potentially exploit the vulnerability to exhaust system resources.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is still important to apply the fix to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
