Memory Leak Vulnerability in nfs Package
Summary
GSD-2021-1001382: nfs: fix acl memory leak of posix_acl_create(). Affects Kernel versions >= 013cdf1088d7235da9477a2375654921d9b9ba9f, < 0704f617040c397ae73c1f88f3956787ec5d6529. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nfs package is a component of the Linux Kernel, which is responsible for providing network file system (NFS) functionality. NFS allows remote file systems to be mounted and accessed over a network. It is widely used in distributed computing environments to share files between systems. The nfs package is an integral part of the Linux Kernel and is present in various Linux distributions.
Vulnerability Detail
The identified vulnerability in the nfs package is a memory leak issue related to the posix_acl_create() function. When creating access control lists (ACLs), the function fails to release allocated memory, leading to a memory leak. This vulnerability can be exploited by an attacker to consume excessive memory resources, potentially causing system instability or denial of service. The vulnerability was introduced in version v3.14 of the Linux Kernel and has been fixed in version v4.19.198.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the memory leak issue by disabling ACL functionality in the nfs package. This can be achieved by modifying the configuration or settings related to ACLs. However, it is important to note that disabling ACLs may limit certain access control capabilities.
Conclusion
In conclusion, the nfs package in the Linux Kernel is vulnerable to a memory leak issue related to the posix_acl_create() function. This vulnerability can be mitigated by updating the Linux Kernel to version v4.19.198 or later. Users can also consider disabling ACL functionality as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The nfs package is a component of the Linux Kernel that provides network file system (NFS) functionality, allowing remote file systems to be mounted and accessed over a network.
The memory leak vulnerability in the nfs package can lead to excessive memory consumption, potentially causing system instability or denial of service.
To fix the vulnerability, it is recommended to update the Linux Kernel to version v4.19.198 or later.
Yes, users can disable ACL functionality in the nfs package as a workaround for the memory leak issue. However, this may limit certain access control capabilities.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
