Memory Leak in drm/nouveau/debugfs in Linux Kernel
Summary
GSD-2021-1001550: drm/nouveau/debugfs: fix file release memory leak. Affects Kernel versions >= 6e9fc177399f08446293fec7607913fdbc95e191, < 1508b09945bde393326a9dab73b1fc35f672d771. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for software to interact with the hardware. The drm/nouveau/debugfs module is a part of the kernel's Direct Rendering Manager (DRM) subsystem and is specifically related to the Nouveau driver, which provides support for NVIDIA GPUs. The debugfs feature allows developers to expose debugging information and configuration options through a virtual file system. However, a memory leak vulnerability has been identified in the drm/nouveau/debugfs module, which could lead to resource exhaustion and potential system instability.
Vulnerability Detail
The memory leak vulnerability in drm/nouveau/debugfs arises from a failure to release allocated memory when certain files are closed. This can result in a gradual accumulation of memory over time, eventually leading to resource exhaustion and potential system crashes. An attacker with local access to the system may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The vulnerability was introduced in Linux Kernel version 4.5 and has been fixed in version 4.19.211 by commit 1508b09945bde393326a9dab73b1fc35f672d771.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The memory leak vulnerability in drm/nouveau/debugfs in the Linux Kernel can lead to resource exhaustion and potential system instability. It is crucial to update the Linux Kernel to version 4.19.211 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and potential system crashes, potentially enabling an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any known vulnerabilities, including this one, are found.
At the moment, there is no known workaround for this vulnerability. It is recommended to update the Linux Kernel to the fixed version as soon as possible.
No, this vulnerability requires local access to the system in order to be exploited.
There are no known instances of this vulnerability being actively exploited in the wild at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
