Memory Leak in net/mlx5e Package
Summary
GSD-2021-1002033: net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path. Affects Kernel versions >= e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c, < 4f7bddf8c5c01cac74373443b13a68e1c6723a94. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a component of the Linux Kernel that provides support for Mellanox network adapters. It includes drivers and utilities for managing and configuring these adapters. The package is responsible for handling various network operations and ensuring efficient data transfer between the network interface and the kernel. However, a vulnerability has been identified in the package that can lead to a memory leak in certain error scenarios.
Vulnerability Detail
The vulnerability in the net/mlx5e package occurs specifically in the mlx5_core_destroy_cq() function. In the error path of this function, a memory leak can occur, causing the system to gradually consume more memory over time. This can lead to performance degradation and potential denial-of-service conditions if the system runs out of available memory. The vulnerability was introduced in version v3.11 of the Linux Kernel and has been fixed in version v5.10.75.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by avoiding the error scenario that triggers the memory leak. This may involve modifying the system configuration or avoiding specific operations that can trigger the vulnerability. However, applying the official patch by updating the kernel is the recommended long-term solution.
Conclusion
The memory leak vulnerability in the net/mlx5e package can lead to performance degradation and potential denial-of-service conditions. It is crucial to update the Linux Kernel to version v5.10.75 or later to address this vulnerability. Applying the official patch is the recommended solution, but a temporary workaround can be implemented until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, causing the system to consume more memory over time. This can result in performance degradation and potential denial-of-service conditions if the system runs out of available memory.
You can use tools like Vulert to scan your system and check for the presence of this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities, without requiring access to the code or installation.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the necessary updates and patches to mitigate the risk.
While updating the kernel is the recommended solution, you can implement a temporary workaround by avoiding the error scenario that triggers the memory leak. This may involve modifying system configurations or avoiding specific operations.
You can refer to the official Linux Kernel repository for detailed information about the vulnerability and the specific fix implemented in version v5.10.75.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
