Memory Leak in __mdiobus_register in Kernel
Summary
GSD-2021-1001769: net: mdiobus: Fix memory leak in __mdiobus_register. Affects Kernel versions < fd2400dd4f1b8bd7a309b1b424d9e0d188151b01. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential services and functions, including device drivers, memory management, and process scheduling. The __mdiobus_register function is responsible for registering a new MDIO bus, which is used for communication between Ethernet PHYs and the Ethernet MAC. However, a memory leak vulnerability has been identified in this function, potentially leading to resource exhaustion and system instability.
Vulnerability Detail
The memory leak vulnerability in __mdiobus_register arises when a new MDIO bus is registered but not properly freed when an error occurs during the registration process. This can result in a continuous accumulation of memory allocations, eventually leading to resource exhaustion and system instability. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability has been assigned the ID GSD-2021-1001769 and has been fixed in Linux Kernel version v4.4.290 by commit fd2400dd4f1b8bd7a309b1b424d9e0d188151b01.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the Kernel to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The memory leak vulnerability in __mdiobus_register in the Kernel can lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v4.4.290 or later to mitigate this vulnerability. Users can also utilize the Vulert Playground to check if their application is affected without requiring access to the code or installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and system instability, potentially resulting in a denial-of-service (DoS) condition or arbitrary code execution with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability without requiring access to the code or installation.
Yes, the vulnerability has been fixed in Linux Kernel version v4.4.290 by commit fd2400dd4f1b8bd7a309b1b424d9e0d188151b01. It is recommended to update the Kernel to this version or later.
The vulnerability itself does not specify whether it can be exploited remotely. However, if an attacker gains access to the affected system, they could potentially exploit this vulnerability.
There is no information available regarding known instances of this vulnerability being exploited at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
