Memory Leak Vulnerability in virtio-blk Package
Summary
GSD-2021-1001332: virtio-blk: Fix memory leak among suspend/resume procedure. Affects Kernel versions < 04c6e60b884cb5e94ff32af46867fb41d5848358. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The virtio-blk package is a component of the Linux Kernel that provides a virtual block device driver for the VirtIO framework. It allows virtual machines to access block devices efficiently. The package is widely used in virtualization environments and is critical for the proper functioning of virtual machines.
Vulnerability Detail
A memory leak vulnerability has been identified in the virtio-blk package during the suspend/resume procedure. This vulnerability could allow an attacker to exhaust system memory resources by repeatedly triggering the suspend/resume process. If exploited, this could lead to a denial of service (DoS) condition, impacting the availability and performance of the affected system. The vulnerability has been assigned the ID GSD-2021-1001332 and has been fixed in Linux Kernel version v5.4.134.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the Linux Kernel to the patched version.
Conclusion
The memory leak vulnerability in the virtio-blk package can be mitigated by updating the Linux Kernel to version v5.4.134 or later. This update includes the necessary fix to prevent the memory leak issue. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could lead to a denial of service (DoS) condition by exhausting system memory resources.
No, this vulnerability requires local access to the system to trigger the suspend/resume procedure.
The vulnerability is present in versions prior to v5.4.134 of the Linux Kernel.
There are no known instances of this vulnerability being exploited in the wild.
For more details about this vulnerability, including the specific commit that fixes it, please refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
