Memory Leak in qib_user_sdma_queue_pkts() in Kernel
Summary
GSD-2021-1002792: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts(). Affects Kernel versions >= 0f8cdfff06829a0b0348b6debc29ff6a61967724, < 79dcbd8176152b860028b62f81a635d987365752. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the security and stability of the system. The qib_user_sdma_queue_pkts() function in the Kernel is responsible for queuing packets for the InfiniBand (IB) and Quadrics (qib) drivers. These drivers enable high-speed communication between nodes in a cluster or network. However, a memory leak vulnerability has been identified in the qib_user_sdma_queue_pkts() function, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The memory leak vulnerability in qib_user_sdma_queue_pkts() arises from a failure to release allocated memory when queuing packets. This can result in a gradual depletion of available memory, leading to performance degradation and, in extreme cases, system crashes. An attacker with access to the affected system could potentially exploit this vulnerability to exhaust system resources, causing denial-of-service (DoS) conditions. The vulnerability was introduced in Kernel version v5.4.157 and has been fixed in version v5.4.169 by commit 79dcbd8176152b860028b62f81a635d987365752.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can mitigate the risk associated with this vulnerability by limiting the usage of the affected functionality. This can be achieved by disabling or restricting access to the InfiniBand and Quadrics drivers, if they are not essential for the system's operation. However, it is important to note that this workaround may impact the functionality and performance of applications relying on these drivers.
Conclusion
The memory leak vulnerability in qib_user_sdma_queue_pkts() can have severe consequences, including resource exhaustion and system instability. It is crucial to update the Kernel to version v5.4.169 or later to mitigate this vulnerability. Additionally, users can apply temporary workarounds by limiting the usage of the affected functionality. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory exhaustion, performance degradation, and potential system crashes. It may also enable attackers to launch denial-of-service (DoS) attacks by exploiting the resource depletion.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this report, no known exploits for this vulnerability have been disclosed. However, it is crucial to apply the recommended fixes and keep the system up to date to mitigate potential risks.
While updating the Kernel to the fixed version is the recommended approach, you can temporarily mitigate the risk by limiting the usage of the affected functionality. This involves disabling or restricting access to the InfiniBand and Quadrics drivers, if they are not essential for your system's operation.
For more detailed information about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002792.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
