Memory Leak in qib_user_sdma_queue_pkts() in Kernel
Summary
GSD-2021-1002776: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts(). Affects Kernel versions >= 3f57c3f67fd93b4da86aeffea1ca32c484d054ad, < 76b648063eb36c72dfc0a6896de8a0a7d2c7841c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The qib_user_sdma_queue_pkts() function in the Kernel is responsible for queuing packets for the InfiniBand (IB) and Quadrics (qib) drivers. These drivers enable high-speed data transfer and communication between nodes in a cluster or network. However, a memory leak vulnerability has been identified in the qib_user_sdma_queue_pkts() function, which can lead to the exhaustion of system memory over time.
Vulnerability Detail
The memory leak vulnerability in qib_user_sdma_queue_pkts() arises due to improper memory management within the function. When packets are queued for transmission, memory resources are allocated but not properly deallocated after the transmission is complete. As a result, the allocated memory remains in use, leading to a gradual depletion of available system memory. This can eventually cause system instability, performance degradation, and even denial-of-service conditions. The vulnerability has the potential to be exploited by an attacker to exhaust system resources and disrupt normal system operation.
How To Fix
No fixed version is published for this vulnerability.
To fix the memory leak vulnerability in qib_user_sdma_queue_pkts(), it is recommended to update the Linux Kernel to version v4.9.295 or later. The fix for this vulnerability was implemented in commit 76b648063eb36c72dfc0a6896de8a0a7d2c7841c of the Linux Kernel repository. Updating the Kernel to the patched version will ensure that the memory leak issue is resolved and system resources are properly managed.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by applying the recommended fix and updating their Linux Kernel to the patched version.
Conclusion
The memory leak vulnerability in qib_user_sdma_queue_pkts() poses a risk of system instability, performance degradation, and potential denial-of-service conditions. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v4.9.295 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability in qib_user_sdma_queue_pkts() can lead to the gradual exhaustion of system memory, resulting in system instability, performance degradation, and potential denial-of-service conditions.
An attacker can exploit this vulnerability by repeatedly triggering the queuing of packets using the qib_user_sdma_queue_pkts() function, causing a continuous allocation of memory resources without proper deallocation. This can lead to the depletion of available system memory and disrupt normal system operation.
At the time of this report, there is no known public exploit available for this vulnerability. However, it is advisable to apply the recommended fix to mitigate the risk.
No, this vulnerability was introduced in version v4.9.290 of the Linux Kernel and is present until version v4.9.294. The vulnerability is fixed in version v4.9.295 and later.
Yes, it is recommended to restart the system after updating the Linux Kernel to ensure that the patched version is fully applied and the memory leak vulnerability is effectively mitigated.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.