ext4: Memory Leak in ext4_fill_super
Summary
GSD-2021-1001298: ext4: fix memory leak in ext4_fill_super. Affects Kernel versions >= ce40733ce93de402ed629762f0e912d9af187cef, < 01d349a481f0591230300a9171330136f9159bcd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 filesystem is a widely used file system in the Linux kernel. It provides features such as journaling, scalability, and support for large file systems. The ext4_fill_super function is responsible for initializing and populating the superblock structure for ext4 filesystems. However, a memory leak vulnerability has been discovered in this function.
Vulnerability Detail
The memory leak vulnerability in ext4_fill_super can be exploited by an attacker to exhaust system memory resources, leading to a denial-of-service condition. When a new ext4 filesystem is mounted, the function allocates memory for the superblock structure but fails to deallocate it in certain error paths. This can result in a continuous allocation of memory without proper release, eventually causing the system to run out of memory.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.43 or later. The fix for this issue was implemented in commit 01d349a481f0591230300a9171330136f9159bcd. Updating the kernel will ensure that the memory leak is patched and no longer exploitable.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid mounting new ext4 filesystems until the kernel is updated to a version that includes the fix. This will prevent the memory leak vulnerability from being triggered.
Conclusion
The ext4 filesystem's ext4_fill_super function contains a memory leak vulnerability that can be exploited to exhaust system memory resources. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.10.43 or later. Users can also use Vulert Playground to check if their system is affected. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service condition by exhausting system memory resources.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will analyze and alert you if the vulnerability is present.
At the time of this report, there is no known exploit for this vulnerability. However, it is still important to apply the fix to prevent potential exploitation.
The recommended mitigation is to update the kernel to a version that includes the fix. However, as a temporary workaround, users can avoid mounting new ext4 filesystems until the kernel is updated.
The primary risk is the denial-of-service condition caused by memory exhaustion. However, if an attacker can trigger the vulnerability repeatedly, it may lead to system instability and impact the overall performance of the affected system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.