Memory Leak in net: caif: ldisc_open
Summary
GSD-2021-1001142: net: caif: fix memory leak in ldisc_open. Affects Kernel versions < 58af3d3d54e87bfc1f936e16c04ade3369d34011. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package in the Linux Kernel is responsible for handling network-related operations. It provides various protocols and interfaces for communication. The caif module within the net package is used for communication between devices over the CAPI2.0 framework. The ldisc_open function in caif is responsible for initializing a line discipline for a communication channel. However, a memory leak vulnerability exists in this function.
Vulnerability Detail
The memory leak vulnerability in ldisc_open can be exploited by an attacker to exhaust system resources, leading to a denial-of-service condition. When a line discipline is opened, memory is allocated for its data structure. However, if an error occurs during the initialization process, the allocated memory is not properly freed, resulting in a memory leak. This can be abused by an attacker to repeatedly open and close line disciplines, eventually depleting available memory and causing the system to become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the exploitation of this vulnerability by limiting the number of line disciplines opened and closed within a short period of time. By reducing the frequency of opening and closing line disciplines, the impact of the memory leak can be mitigated. However, this is only a temporary solution, and updating to the patched version is still recommended.
Conclusion
The memory leak vulnerability in net: caif: ldisc_open can be mitigated by updating the Linux Kernel to version v5.13 or later. This will ensure that the memory leak is properly handled and system resources are freed when necessary. It is important to promptly apply the patch to prevent potential denial-of-service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service condition by exhausting system resources.
An attacker can repeatedly open and close line disciplines, causing a memory leak and depleting available memory.
Yes, users can limit the frequency of opening and closing line disciplines to mitigate the impact of the memory leak temporarily.
Updating the Linux Kernel to version v5.13 or later, which includes the fix for this issue.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) with the ID GSD-2021-1001142.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
