Memory Leak Vulnerability in nfp Package
Summary
GSD-2021-1002426: nfp: Fix memory leak in nfp_cpp_area_cache_add(). Affects Kernel versions >= 4cb584e0ee7df70fd0376aee60cf701855ea8c81, < eb51f639ef3fd5498b7def290ed8681b6aadd9a7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nfp package is a component of the Linux Kernel, which is responsible for managing the Netronome Flow Processor (NFP) devices. These devices are used for offloading network-related tasks, such as packet processing and traffic management, from the CPU. The nfp package provides the necessary drivers and firmware to enable communication with NFP devices. However, a memory leak vulnerability has been discovered in the nfp_cpp_area_cache_add() function, which can lead to resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability in the nfp package arises from a memory leak in the nfp_cpp_area_cache_add() function. When this function is called to add an area to the cache, it fails to release the allocated memory if an error occurs during the process. As a result, memory resources are not properly freed, leading to a gradual depletion of available memory. This can eventually cause system instability or even crashes. Attackers may exploit this vulnerability by repeatedly triggering the affected function, exhausting the system's memory resources and rendering it unresponsive.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.221 or later. This update includes a commit (eb51f639ef3fd5498b7def290ed8681b6aadd9a7) that addresses the memory leak issue in the nfp_cpp_area_cache_add() function. Users can obtain the updated kernel from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/). Once the updated kernel is installed, the vulnerability should be mitigated.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is necessary to apply the recommended fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in the nfp package can lead to resource exhaustion and potential denial-of-service attacks. It is recommended to update the Linux Kernel to version v4.19.221 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability in the nfp package can lead to resource exhaustion and potential denial-of-service attacks. It can cause system instability or crashes, rendering the affected system unresponsive.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any open-source vulnerabilities, including this memory leak vulnerability, are found.
At the time of this report, no known exploits for this vulnerability have been disclosed. However, it is important to apply the recommended fix promptly to mitigate the risk.
This vulnerability requires local access to the affected system to trigger the memory leak. However, if an attacker gains local access, they can exploit the vulnerability to exhaust system memory and potentially disrupt its operation.
There is no evidence of active attacks exploiting this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.