Memory Leak in m_can_read_fifo Function in Kernel
Summary
GSD-2021-1002587: can: m_can: m_can_read_fifo: fix memory leak in error branch. Affects Kernel versions >= e39381770ec9ca3c51d8b9bd9cc6e01d78ea974a, < 75a422165477dd12d2d20aa7c9ee7c9a281c9908. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The m_can_read_fifo function is a part of the Controller Area Network (CAN) subsystem in the Kernel, which is responsible for handling CAN bus communication. The function is used to read data from the CAN receive FIFO (First-In-First-Out) buffer. However, a memory leak vulnerability has been identified in the error branch of the m_can_read_fifo function.
Vulnerability Detail
The memory leak vulnerability in the m_can_read_fifo function occurs when an error condition is encountered during the reading of data from the CAN receive FIFO buffer. In this scenario, memory allocated for the received data is not properly freed, leading to a memory leak. An attacker could potentially exploit this vulnerability by repeatedly triggering the error condition, causing a gradual depletion of available memory resources. This could result in system instability, performance degradation, or even a complete denial of service. The vulnerability was introduced in version v5.15 of the Linux Kernel and has been fixed in version v5.15.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by modifying the m_can_read_fifo function to properly free the allocated memory in the error branch. The following code snippet demonstrates the necessary modification:
if (error_condition) {
kfree(received_data);
return error_code;
}
Conclusion
In conclusion, the m_can_read_fifo function in the Kernel is vulnerable to a memory leak issue. This vulnerability can be mitigated by updating the Linux Kernel to version v5.15.8 or later. If immediate update is not possible, a temporary workaround can be applied by modifying the m_can_read_fifo function to free the allocated memory in the error branch. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, which can result in system instability, performance degradation, or denial of service.
An attacker can exploit this vulnerability by repeatedly triggering the error condition in the m_can_read_fifo function, causing a gradual depletion of available memory resources.
The vulnerability was introduced in version v5.15 of the Linux Kernel.
Yes, the vulnerability has been fixed in version v5.15.8 of the Linux Kernel.
It is recommended to update the Linux Kernel to version v5.15.8 or later to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
