Memory Leak Vulnerability in tracing/histograms Package
Summary
GSD-2022-1004586: tracing/histograms: Fix memory leak problem. Affects Kernel versions >= 46bbe5c671e06f070428b9be142cc4ee5cedebac, < 78a1400c42ee11197eb1f0f85ba51df9a4fdfff0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tracing/histograms package is a component of the Linux Kernel, which is responsible for collecting and analyzing various system events and generating histograms based on the collected data. It is used for performance monitoring and debugging purposes. However, a memory leak vulnerability has been identified in this package, which could lead to resource exhaustion and potential system instability.
Vulnerability Detail
The memory leak vulnerability in the tracing/histograms package allows an attacker to cause a continuous allocation of memory without proper deallocation, leading to a gradual depletion of system resources. This can result in degraded system performance, unresponsive applications, and even system crashes. The vulnerability was introduced in version v5.9 of the Linux Kernel and was fixed in version v5.10.132. The root cause of the vulnerability is a missing deallocation of memory in certain code paths.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can mitigate the impact of this vulnerability by periodically restarting the affected system to free up the accumulated memory. However, this is not a permanent solution and should be followed by applying the official patch as soon as possible.
Conclusion
The memory leak vulnerability in the tracing/histograms package of the Linux Kernel can lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v5.10.132 or later to address this vulnerability. In the meantime, periodic system restarts can be used as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability can lead to resource exhaustion, degraded system performance, unresponsive applications, and potential system crashes.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this memory leak vulnerability.
Yes, a temporary workaround is to periodically restart the affected system to free up the accumulated memory. However, this is not a permanent solution and should be followed by applying the official patch as soon as possible.
To update the Linux Kernel, you can obtain the latest version (v5.10.132 or later) from the official Linux Kernel repository. Follow the installation instructions provided by your Linux distribution to apply the update.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the patch promptly to mitigate the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
