Memory Leak Vulnerability in fsl_ifc Package
Summary
GSD-2021-1001444: memory: fsl_ifc: fix leak of IO mapping on probe failure. Affects Kernel versions >= a20cbdeffce247a2b6fb83cd8d22433994068565, < d0d04b95e8ed0223844a1d58497c686fe2e4a955. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fsl_ifc package is a component of the Linux Kernel, which is responsible for handling memory management and input/output (IO) operations. It provides functionality for mapping IO addresses and managing memory resources. The package is widely used in Linux-based systems, particularly those utilizing Freescale processors. However, a vulnerability has been discovered in the fsl_ifc package that can lead to a memory leak when the probe operation fails.
Vulnerability Detail
The vulnerability in the fsl_ifc package occurs when the probe operation fails, resulting in a memory leak of IO mappings. This can lead to resource exhaustion and potential denial-of-service (DoS) attacks. An attacker could exploit this vulnerability by repeatedly triggering the probe failure, causing the system to run out of memory and become unresponsive. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v4.9.276 by commit d0d04b95e8ed0223844a1d58497c686fe2e4a955.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented to mitigate the vulnerability. The workaround involves modifying the fsl_ifc driver code to handle the probe failure gracefully and release any allocated IO mappings. Here is an example of the code modification:
// Add the following code snippet in the fsl_ifc driver
if (probe_failed) {
// Release IO mappings
release_io_mappings();
}
Conclusion
In conclusion, the fsl_ifc package in the Linux Kernel is vulnerable to a memory leak issue when the probe operation fails. This vulnerability can lead to resource exhaustion and potential denial-of-service attacks. It is crucial to update the Kernel to version v4.9.276 or later to fix this vulnerability. If immediate updating is not possible, the provided workaround can be implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, which can result in resource exhaustion and potential denial-of-service (DoS) attacks. An attacker could exploit this vulnerability to cause the system to become unresponsive.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability has been fixed in version v4.9.276 of the Linux Kernel. It is recommended to update to this version or later to ensure the security of your system.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the necessary updates and fixes to prevent any potential exploitation.
Yes, you can apply the provided workaround mentioned earlier in this report to mitigate the vulnerability until you are able to update the Kernel. However, it is still recommended to update the Kernel as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
