Memory Leak Vulnerability in phy: mdio Package
Summary
GSD-2021-1001629: phy: mdio: fix memory leak. Affects Kernel versions >= 46abc02175b3c246dd5141d878f565a8725060c9, < 0d2dd40a7be61b89a7c99dae8ee96389d27b413a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The phy: mdio package is a component of the Linux Kernel, which is responsible for managing the Media Independent Interface (MII) bus for Ethernet PHY devices. It provides the necessary functionality for communication between the Ethernet controller and the PHY devices. The vulnerability in this package relates to a memory leak issue.
Vulnerability Detail
The memory leak vulnerability in phy: mdio can lead to the gradual depletion of system memory resources. When the package is used to communicate with Ethernet PHY devices, it fails to release allocated memory properly, resulting in a continuous accumulation of memory over time. This can eventually lead to system instability, performance degradation, and even denial-of-service conditions. The vulnerability was introduced in version v2.6.28 of the Linux Kernel and has been fixed in version v5.10.73.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The memory leak vulnerability in phy: mdio can have serious consequences for system stability and performance. It is crucial to update the Linux Kernel to version v5.10.73 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability in phy: mdio can lead to system instability, performance degradation, and denial-of-service conditions due to the gradual depletion of system memory resources.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes the package-lock.json file of your application and provides real-time alerts for open-source vulnerabilities.
No, there is no specific workaround available for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
The vulnerability was introduced in version v2.6.28 of the Linux Kernel. All versions between v2.6.28 and v5.10.73 are affected.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001629.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
