Memory Leak in __mdiobus_register in Kernel
Summary
GSD-2021-1001941: net: mdiobus: Fix memory leak in __mdiobus_register. Affects Kernel versions < bc5f2f3431ced08300e4cb3aff35f1da14c26433. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is the core component of the Linux operating system that manages system resources and provides an interface for applications to interact with hardware. It includes various subsystems, including the network subsystem. The network subsystem handles the communication between the computer and the network, including Ethernet connections. The mdiobus subsystem is responsible for managing the Media Independent Interface (MII) buses, which are used for communication between Ethernet PHYs and the network controller. The __mdiobus_register function is a part of this subsystem and is used to register a new MII bus. However, a memory leak vulnerability exists in this function, which can lead to the exhaustion of system memory over time.
Vulnerability Detail
The vulnerability in __mdiobus_register function allows an attacker to trigger a memory leak by repeatedly registering new MII buses without properly releasing the allocated memory. This can result in the gradual depletion of system memory, leading to performance degradation or even denial of service. The vulnerability has been fixed in Linux Kernel version v4.9.288 by commit bc5f2f3431ced08300e4cb3aff35f1da14c26433.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch or update the kernel to the fixed version to mitigate the risk.
Conclusion
The memory leak vulnerability in __mdiobus_register function of the Kernel can lead to system performance degradation or denial of service. It is crucial to update the Linux Kernel to version v4.9.288 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a gradual depletion of system memory, resulting in performance degradation or denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the patch or update the kernel to mitigate the risk.
This vulnerability requires an attacker to have local access to the system to trigger the memory leak. It cannot be exploited remotely over a network.
The only known solution is to update the Linux Kernel to the fixed version. Applying the patch or updating the kernel is the recommended approach.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
