Memory Leak Vulnerability in zr364xx Media Driver
Summary
GSD-2021-1001426: media: zr364xx: fix memory leak in zr364xx_start_readpipe. Affects Kernel versions >= ccbf035ae5de4c535160fc99f73feb44cc55b534, < b0633051a6cb24186ff04ce1af99c7de18c1987e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The zr364xx media driver is a component of the Linux Kernel, which provides support for certain USB webcams. It allows users to capture video and images from these devices. The driver is responsible for managing the communication between the webcam and the operating system. However, a memory leak vulnerability has been discovered in the zr364xx_start_readpipe function of the driver.
Vulnerability Detail
The zr364xx_start_readpipe function in the zr364xx media driver suffers from a memory leak vulnerability. This vulnerability can be triggered when the driver fails to release allocated memory in certain error scenarios. An attacker with local access to the system could exploit this vulnerability to cause a denial of service condition by exhausting system memory resources. Additionally, this memory leak could potentially be leveraged for further exploitation, such as bypassing memory-based security mitigations or escalating privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the official patch or update the Linux Kernel to the recommended version.
Conclusion
The memory leak vulnerability in the zr364xx media driver of the Linux Kernel can lead to a denial of service condition and potential further exploitation. It is crucial to update the Linux Kernel to version v4.14.240 or later to mitigate this vulnerability. Users can obtain the updated kernel from the official Linux Kernel repository. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial of service condition by exhausting system memory resources. It could also potentially be exploited for further attacks, such as privilege escalation.
Any system running the affected versions of the Linux Kernel with the zr364xx media driver enabled is vulnerable to this issue.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, a patch for this vulnerability is available in the Linux Kernel version v4.14.240 and later.
Yes, disabling the zr364xx media driver would mitigate this vulnerability. However, this may impact the functionality of USB webcams that rely on this driver.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
