Memory Leak Vulnerability in io_uring
Summary
GSD-2021-1001167: io_uring: fix memleak in io_init_wq_offload(). Affects Kernel versions >= e941894eae31b52f0fd9bdb3ce20620afa152f45, < 502731a03f27cba1513fbbff77e508185ffce5bb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io_uring package is a subsystem in the Linux Kernel that provides asynchronous I/O and event notification mechanisms. It allows applications to efficiently handle large numbers of I/O operations without blocking the execution flow. The package is widely used in various Linux-based systems and applications.
Vulnerability Detail
The vulnerability identified as GSD-2021-1001167 in the io_uring package is a memory leak issue in the io_init_wq_offload() function. This function is responsible for initializing the work queue offload feature in io_uring. The vulnerability can be triggered when this function fails to release allocated memory in certain error scenarios. An attacker could potentially exploit this vulnerability to exhaust system memory resources, leading to a denial-of-service condition or other unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerable code path by refraining from using the work queue offload feature in io_uring. However, this may not be a feasible solution for applications that rely on this feature. It is strongly advised to apply the official fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in io_uring's io_init_wq_offload() function can have serious consequences, including denial-of-service and unexpected behavior. It is crucial to update the Linux Kernel to the latest version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
io_uring is a subsystem in the Linux Kernel that provides asynchronous I/O and event notification mechanisms.
The vulnerability can lead to a memory leak, potentially causing a denial-of-service condition or other unexpected behavior.
To fix this vulnerability, update the Linux Kernel to version v5.13.6 or later.
A workaround is to avoid using the work queue offload feature in io_uring, but it is recommended to apply the official fix by updating the Linux Kernel.
For more details, refer to the vulnerability ID GSD-2021-1001167 in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001167.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
