Memory Leak in dwc2_hcd_init in Kernel
Summary
GSD-2022-1004837: usb: dwc2: Fix memory leak in dwc2_hcd_init. Affects Kernel versions >= a7182993dd8e09f96839ddc3ac54f9b37370d282, < 84e6d0af87e27bbc0db94f2e7323b34abe17b6e5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that provides core functionalities and acts as an interface between the hardware and software layers. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The dwc2 module within the Kernel is responsible for handling USB functionality. It enables USB communication and supports various USB devices.
However, a vulnerability has been identified in the dwc2_hcd_init function, which can lead to a memory leak. This function is responsible for initializing the DWC2 host controller driver. The memory leak occurs when the initialization process fails, resulting in unreleased memory resources. If exploited, this vulnerability can lead to resource exhaustion, system instability, and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability in dwc2_hcd_init arises from a memory leak issue. When the initialization of the DWC2 host controller driver fails, memory resources allocated during the process are not properly released. This can result in a gradual depletion of available memory, leading to resource exhaustion and potential system instability.
An attacker could potentially exploit this vulnerability by repeatedly triggering the initialization process, causing the memory leak to accumulate over time. This could result in a denial-of-service condition, where the system becomes unresponsive or crashes due to insufficient memory.
The vulnerability was introduced in version v4.19.210 of the Linux Kernel by commit a7182993dd8e09f96839ddc3ac54f9b37370d282. However, it has been fixed in version v4.19.249 by commit 84e6d0af87e27bbc0db94f2e7323b34abe17b6e5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The memory leak vulnerability in dwc2_hcd_init can have serious consequences, including resource exhaustion and potential denial-of-service attacks. It is crucial to update the Linux Kernel to version v4.19.249 or later to mitigate this vulnerability. By applying the necessary patch, the memory leak issue is resolved, ensuring system stability and security.
For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, resulting in resource exhaustion and potential system instability. It can be exploited to launch denial-of-service attacks.
An attacker can trigger the initialization process of the DWC2 host controller driver repeatedly, causing the memory leak to accumulate over time and potentially leading to a denial-of-service condition.
The vulnerability was introduced in version v4.19.210 of the Linux Kernel. Versions prior to v4.19.249 are affected.
Yes, the vulnerability has been fixed in version v4.19.249 of the Linux Kernel.
To update the Linux Kernel, identify the current version installed, check for available updates, download and install the latest version, and reboot the system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
