Vulnerability in dma-buf/sync_file Package: Fences Leak on Merge Failure
Summary
GSD-2021-1001406: dma-buf/sync_file: Don't leak fences on merge failure. Affects Kernel versions >= a02b9dc90d844cc7df7b63264e7920cc425052d9, < 19f51c2529339280d2c8c6427cd3e21ddf1ac3f8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dma-buf/sync_file package is a component of the Linux Kernel, which is responsible for managing shared buffers between multiple devices. It provides a synchronization mechanism for coordinating access to these buffers. The package allows for the creation and management of sync files, which are used to track the synchronization state of the buffers. These sync files contain a collection of fences that represent synchronization points in the buffer's lifecycle. The fences ensure that operations on the buffer are executed in the correct order and prevent data corruption or race conditions. However, a vulnerability has been discovered in the package that can lead to the leakage of fences when a merge failure occurs.
Vulnerability Detail
The vulnerability in the dma-buf/sync_file package occurs when a merge operation fails. In this scenario, the package fails to properly handle the cleanup of fences, resulting in a resource leak. An attacker could potentially exploit this vulnerability to exhaust system resources, leading to a denial-of-service condition. Additionally, the leaked fences may contain sensitive information, which could be leveraged by an attacker to gain unauthorized access or perform further attacks. The vulnerability was introduced in version v4.9 of the Linux Kernel and was fixed in version v4.14.241.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the dma-buf/sync_file package can result in the leakage of fences on merge failure, leading to resource exhaustion and potential unauthorized access. It is crucial to update the Linux Kernel to version v4.14.241 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dma-buf/sync_file package is a component of the Linux Kernel that manages shared buffers between multiple devices. It provides synchronization mechanisms for coordinating access to these buffers.
A sync file is a data structure used by the dma-buf/sync_file package to track the synchronization state of shared buffers. It contains a collection of fences that represent synchronization points in the buffer's lifecycle.
A fence is a synchronization primitive used by the dma-buf/sync_file package to ensure that operations on shared buffers are executed in the correct order. It prevents data corruption and race conditions.
The vulnerability in the dma-buf/sync_file package can lead to the leakage of fences when a merge operation fails. This can result in a resource leak, potentially leading to a denial-of-service condition. The leaked fences may also contain sensitive information, which could be exploited by an attacker.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.241 or later. This update includes the necessary fix for the issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
