Memory Leak in fsl_ifc on Probe Failure
Summary
GSD-2021-1001373: memory: fsl_ifc: fix leak of IO mapping on probe failure. Affects Kernel versions >= a20cbdeffce247a2b6fb83cd8d22433994068565, < 94bc2fe46102d1e060fc749c0c19511e76c9995f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fsl_ifc is a memory driver in the Linux Kernel that provides support for the Freescale Integrated Flash Controller (IFC) found in certain Freescale processors. It is responsible for managing the IFC memory and providing access to it. The driver is used in various embedded systems and devices that utilize Freescale processors. However, a vulnerability has been discovered in the fsl_ifc driver that can lead to a memory leak when the driver fails to probe properly.
Vulnerability Detail
The vulnerability in the fsl_ifc driver occurs when the driver fails to properly handle a probe failure. During the probe process, the driver maps the IFC memory to the kernel's address space. If the probe fails, the driver does not properly clean up the mapping, resulting in a memory leak. An attacker could potentially exploit this vulnerability by repeatedly triggering probe failures, leading to a depletion of system memory and potentially causing a denial-of-service condition. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v4.19.198.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a workaround for this vulnerability is to avoid triggering probe failures in the fsl_ifc driver. This can be achieved by ensuring that the driver is properly configured and all necessary dependencies are met before attempting to load the driver. Additionally, monitoring system logs for any probe failure messages related to the fsl_ifc driver can help identify potential issues and prevent the vulnerability from being exploited.
Conclusion
The memory leak vulnerability in the fsl_ifc driver can be mitigated by updating the Linux Kernel to version v4.19.198 or later. This update includes a fix for the vulnerability, ensuring that the driver properly cleans up IO mapping on probe failure. If immediate kernel update is not possible, implementing the provided workaround and monitoring system logs can help prevent exploitation of the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The fsl_ifc driver is a memory driver in the Linux Kernel that provides support for the Freescale Integrated Flash Controller (IFC) found in certain Freescale processors. It manages the IFC memory and provides access to it.
The vulnerability can lead to a memory leak in the fsl_ifc driver, potentially causing a depletion of system memory and a denial-of-service condition.
An attacker could exploit this vulnerability by repeatedly triggering probe failures in the fsl_ifc driver, leading to a memory leak and potential denial-of-service.
Yes, this vulnerability has been fixed in Linux Kernel version v4.19.198 by commit 94bc2fe46102d1e060fc749c0c19511e76c9995f.
A workaround for this vulnerability is to avoid triggering probe failures in the fsl_ifc driver and to monitor system logs for any related probe failure messages.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
