Memory Leak in __mdiobus_register in Kernel
Summary
GSD-2021-1001836: net: mdiobus: Fix memory leak in __mdiobus_register. Affects Kernel versions < 3a0dc2e35a5d6546b1db87fe985582dadc64fe7b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between hardware and software. It provides essential services and functions, including device drivers, memory management, and process scheduling. The __mdiobus_register function is part of the network subsystem in the Kernel and is responsible for registering a management data input/output bus (MDIO bus). The MDIO bus is used to communicate with Ethernet PHYs (Physical Layer transceivers) and other network devices. This vulnerability in __mdiobus_register can lead to a memory leak, which can result in resource exhaustion and system instability.
Vulnerability Detail
The vulnerability in __mdiobus_register arises due to a memory leak. When a new MDIO bus is registered, memory is allocated to store its information. However, if the registration process encounters an error, the allocated memory is not properly freed, leading to a memory leak. Over time, repeated registrations and failures can deplete the available memory, causing resource exhaustion and potentially crashing the system. An attacker may be able to exploit this vulnerability to launch denial-of-service attacks or gain elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by avoiding the registration of MDIO buses that are known to cause errors. This can be achieved by modifying the code that calls __mdiobus_register and excluding the problematic MDIO buses. However, this workaround is not a permanent solution and should be used only until the Kernel update can be applied.
Conclusion
The memory leak vulnerability in __mdiobus_register in the Kernel can lead to resource exhaustion and system instability. It is crucial to update the Kernel to the fixed version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, causing resource exhaustion and system instability. It can potentially be exploited by attackers to launch denial-of-service attacks or gain elevated privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities, including this specific issue.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix or workaround to mitigate the risk.
This vulnerability does not have a direct remote exploitation vector. However, if an attacker gains access to the system, they may be able to trigger the vulnerability and exploit it for their advantage.
The recommended solution is to update the Linux Kernel to the fixed version. However, if updating the Kernel is not feasible, implementing strict access controls and monitoring can help mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
