Memory Leak in __mdiobus_register in Kernel
Summary
GSD-2021-1002014: net: mdiobus: Fix memory leak in __mdiobus_register. Affects Kernel versions < b0feaa8376f52357bf2fd020d0c471713a859728. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The __mdiobus_register function is part of the mdiobus subsystem in the Kernel, which handles the management of Media Independent Interface (MII) buses. MII buses are used for communication between Ethernet PHYs and network controllers. This vulnerability in __mdiobus_register can lead to a memory leak, potentially causing resource exhaustion and system instability.
Vulnerability Detail
The vulnerability in __mdiobus_register arises from a memory leak issue. When registering a new MII bus, the function fails to release allocated memory in certain error paths. This can result in a continuous accumulation of memory, leading to resource exhaustion over time. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition by repeatedly triggering the error paths and depleting system resources. The impact of this vulnerability depends on the specific context in which the Kernel is used and the availability of system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
The memory leak vulnerability in __mdiobus_register in the Kernel can lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v5.4.156 or later to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific context and available system resources. It can potentially lead to resource exhaustion and system instability, resulting in a denial-of-service (DoS) condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
At the time of this report, there is no known exploit available for this vulnerability. However, it is always recommended to apply security patches and updates to mitigate potential risks.
If updating the Kernel is not immediately feasible, it is recommended to implement other security measures such as network segmentation, access controls, and monitoring to reduce the risk of exploitation.
You can find more information about this vulnerability in the Cloud Security Alliance's GSD database. The specific vulnerability ID is GSD-2021-1002014.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
