Memory Leak in net/mlx5e Package
Summary
GSD-2021-1002151: net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path. Affects Kernel versions >= e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c, < 94b960b9deffc02fc0747afc01f72cc62ab099e3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx5e package is a component of the Linux Kernel that provides support for Mellanox Ethernet devices. It includes drivers and utilities for managing and configuring these devices. The package is responsible for handling network traffic and ensuring efficient communication between the operating system and the Mellanox hardware.
Vulnerability Detail
The vulnerability identified in the net/mlx5e package is related to a memory leak in the error path of the mlx5_core_destroy_cq() function. When an error occurs during the destruction of a completion queue (CQ), memory resources are not properly released, leading to a memory leak. This vulnerability can potentially result in the exhaustion of system memory resources over time, impacting system performance and stability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the error path of mlx5_core_destroy_cq() by ensuring that the destruction of completion queues is performed correctly and without errors. This can be achieved by following best practices and guidelines provided by the Mellanox documentation for managing and configuring Ethernet devices.
Conclusion
In conclusion, the net/mlx5e package in the Linux Kernel is vulnerable to a memory leak in the mlx5_core_destroy_cq() function. This vulnerability can be mitigated by updating the kernel to version v5.15 or later. Users can also follow best practices and guidelines provided by Mellanox for managing and configuring Ethernet devices. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/mlx5e package is a component of the Linux Kernel that provides support for Mellanox Ethernet devices.
This vulnerability can result in a memory leak, potentially leading to the exhaustion of system memory resources and impacting system performance and stability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15 or later.
Yes, users can avoid triggering the error path by ensuring correct and error-free destruction of completion queues.
Additional information and best practices can be found in the Mellanox documentation for managing and configuring Ethernet devices.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
