Memory Leak in RDS Receive Message Function in Linux Kernel
Summary
GSD-2021-1001056: net: rds: fix memory leak in rds_recvmsg. Affects Kernel versions >= bdbe6fbc6a2f2ccfb384b141b257677d2a8d36fb, < b25b60d076164edb3025e85aabd2cf50a5215b91. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The RDS (Reliable Datagram Sockets) protocol is a kernel-level protocol used for high-performance, low-latency communication between processes on different machines. The rds_recvmsg function in the RDS module is responsible for receiving messages over the RDS protocol. However, a memory leak vulnerability has been discovered in this function.
Vulnerability Detail
The memory leak vulnerability in the rds_recvmsg function allows an attacker to repeatedly send specially crafted messages to a vulnerable system, causing it to exhaust available memory resources. This can lead to a denial-of-service condition, where the system becomes unresponsive or crashes due to lack of memory. The vulnerability was introduced in version 2.6.30 of the Linux Kernel and has been present in subsequent versions until it was fixed in version 5.12.13. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above as soon as possible.
Conclusion
The memory leak vulnerability in the rds_recvmsg function of the Linux Kernel can be exploited to exhaust available memory resources, leading to a denial-of-service condition. It is crucial to update the Linux Kernel to version 5.12.13 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware.
The RDS (Reliable Datagram Sockets) protocol is a kernel-level protocol used for high-performance, low-latency communication between processes on different machines.
The rds_recvmsg function is part of the RDS module in the Linux Kernel and is responsible for receiving messages over the RDS protocol.
A memory leak vulnerability occurs when a program or system fails to release allocated memory after it is no longer needed. This can lead to a gradual depletion of available memory resources, potentially causing the system to become unresponsive or crash.
To update the Linux Kernel, you can download the latest kernel source code from the official Linux Kernel Git repository and compile it for your system. Alternatively, you can check for available updates in your Linux distribution's package manager and install the latest kernel package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
