Memory Leak Vulnerability in zr364xx
Summary
GSD-2021-1001396: media: zr364xx: fix memory leak in zr364xx_start_readpipe. Affects Kernel versions >= ccbf035ae5de4c535160fc99f73feb44cc55b534, < 021c294dff030f3ba38eb81e400ba123db32ecbc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zr364xx is a media driver in the Linux Kernel that provides support for ZR364xx-based USB webcams. It allows users to capture video and images from these webcams. The vulnerability in zr364xx_start_readpipe function can lead to a memory leak. This function is responsible for starting the read pipe for the webcam, and the memory leak occurs when the function fails to release allocated memory in certain error conditions.
Vulnerability Detail
The memory leak vulnerability in zr364xx_start_readpipe function can be exploited by an attacker to exhaust system memory resources, leading to a denial of service (DoS) condition. By repeatedly triggering the vulnerable function, an attacker can cause the system to run out of memory, resulting in degraded performance or system crash. This vulnerability can be particularly impactful in scenarios where the webcam is frequently used or in systems with limited memory resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by avoiding the use of the affected webcam or limiting its usage. By minimizing the usage of the webcam, the likelihood of triggering the vulnerable function and encountering the memory leak can be reduced.
Conclusion
The memory leak vulnerability in zr364xx_start_readpipe function can have serious consequences, including system crashes and degraded performance. It is crucial to update the Linux Kernel to the fixed version or implement the suggested workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
zr364xx is a media driver in the Linux Kernel that provides support for ZR364xx-based USB webcams.
The vulnerability can lead to a memory leak, which can exhaust system memory resources and result in a denial of service (DoS) condition.
An attacker can exploit this vulnerability by repeatedly triggering the vulnerable function, causing the system to run out of memory and potentially leading to system crash or degraded performance.
Yes, the vulnerability has been fixed in Linux Kernel version v4.19.198 by commit 021c294dff030f3ba38eb81e400ba123db32ecbc.
A temporary workaround is to limit the usage of the affected webcam or avoid using it until the Linux Kernel is updated.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
