Memory Leak Vulnerability in nfs Package
Summary
GSD-2021-1001191: nfs: fix acl memory leak of posix_acl_create(). Affects Kernel versions >= 013cdf1088d7235da9477a2375654921d9b9ba9f, < 687cf32865b2d6960214bce523f2afac58dd3cd2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nfs package is a component of the Linux Kernel, which is responsible for providing network file system support. It allows remote file systems to be mounted and accessed over a network. The package is widely used in Linux distributions and plays a crucial role in enabling file sharing and collaboration across multiple machines. However, a memory leak vulnerability has been identified in the package, which can lead to resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The memory leak vulnerability in the nfs package occurs specifically in the posix_acl_create() function. When creating an access control list (ACL), the function fails to release the allocated memory, resulting in a memory leak. This vulnerability can be exploited by an attacker to exhaust system resources, potentially leading to a system crash or slowdown. The impact and attack plausibility of this vulnerability have not been proven yet, but it is essential to address it to ensure the stability and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to avoid using ACLs in the nfs package until the update can be applied. By refraining from creating ACLs, the memory leak vulnerability can be mitigated. However, this workaround is temporary, and it is still recommended to update the Kernel as soon as possible.
Conclusion
The memory leak vulnerability in the nfs package can lead to resource exhaustion and potential denial-of-service attacks. It is recommended to update the Linux Kernel to version v5.13.4 or later to fix this issue. If immediate updating is not possible, avoiding the use of ACLs in the nfs package can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The nfs package is a component of the Linux Kernel that enables network file system support, allowing remote file systems to be mounted and accessed over a network.
This vulnerability can lead to a memory leak, potentially causing resource exhaustion and system instability. It may also open the door for denial-of-service attacks.
To fix this vulnerability, update the Linux Kernel to version v5.13.4 or later, which includes the necessary patch to address the memory leak.
A temporary workaround is to avoid using ACLs in the nfs package until the Kernel update can be applied. This can help mitigate the memory leak vulnerability.
The impact and attack plausibility of this vulnerability have not been proven yet. However, it is crucial to address it promptly to ensure system security.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
