net: stmmac: Fix Memory Leaks in Probe
Summary
GSD-2022-1004395: net: stmmac: fix leaks in probe. Affects Kernel versions >= 2bb4b98b60d7dc89fc0a5bb64534be348ab654df, < f4bd3202a2b4194ab6c0ce61628095d54f994db4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stmmac package is a network driver for Ethernet controllers based on the Synopsys DesignWare Ethernet MAC (stmmac) IP. It provides support for various features such as link management, packet transmission, and reception. The stmmac driver is commonly used in Linux-based systems to enable network connectivity.
However, a vulnerability has been discovered in the stmmac driver's probe function, which can lead to memory leaks. During the initialization process, if certain conditions are met, memory allocated for data structures may not be properly freed, resulting in memory leaks. These leaks can gradually consume system resources and potentially lead to performance degradation or even system instability.
Vulnerability Detail
The vulnerability in the stmmac driver's probe function arises from improper handling of memory allocation and deallocation. When certain conditions are met during the initialization process, memory allocated for data structures is not released correctly, leading to memory leaks. This can result in a gradual consumption of system resources, potentially impacting system performance and stability over time.
The vulnerability was introduced in version v5.14 of the Linux Kernel by commit 2bb4b98b60d7dc89fc0a5bb64534be348ab654df and is fixed in version v5.15.56 by commit f4bd3202a2b4194ab6c0ce61628095d54f994db4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can unload and reload the stmmac driver module after a certain period of time to release the accumulated memory. This can be achieved by executing the following commands:
$ sudo rmmod stmmac
$ sudo modprobe stmmac
Conclusion
The stmmac driver in the Linux Kernel is vulnerable to memory leaks in its probe function. These leaks can gradually consume system resources and potentially impact system performance and stability. It is recommended to update the Linux Kernel to version v5.15.56 or later to fix this vulnerability. Alternatively, users can unload and reload the stmmac driver module periodically as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory leaks in the stmmac driver, gradually consuming system resources and potentially impacting system performance and stability.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, no known exploits for this vulnerability have been identified. However, it is still important to apply the necessary fixes to prevent potential exploitation.
While it is technically possible to manually patch the stmmac driver code to fix this vulnerability, it is generally recommended to update the entire Linux Kernel to a version that includes the official fix. This ensures that all relevant security updates and bug fixes are applied.
You can find more information about this vulnerability, including the specific commits that introduced and fixed it, in the vulnerability database maintained by the Cloud Security Alliance. The source for this vulnerability report can be found at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1004xxx/GSD-2022-1004395.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
