Memory Leak in qib_user_sdma_queue_pkts() in Kernel
Summary
GSD-2021-1002821: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts(). Affects Kernel versions >= d39bf40e55e666b5905fdbd46a0dced030ce87be, < aefcc25f3a0cd28a87d11d41d30419a12cd26a34. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The qib_user_sdma_queue_pkts() function in the Kernel is responsible for queuing packets for the InfiniBand (IB) and Quadrics (qib) drivers. These drivers enable high-speed data transfer between nodes in a cluster or network. However, a memory leak vulnerability has been identified in the qib_user_sdma_queue_pkts() function, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The memory leak vulnerability in qib_user_sdma_queue_pkts() arises from a failure to release allocated memory when queuing packets for the IB and qib drivers. This can result in a gradual depletion of available memory resources, leading to degraded system performance and, in extreme cases, system crashes. An attacker with access to the affected system could potentially exploit this vulnerability to exhaust system resources, causing a denial-of-service (DoS) condition. The vulnerability was introduced in Linux Kernel version v5.15 and has been fixed in version v5.15.12 by commit aefcc25f3a0cd28a87d11d41d30419a12cd26a34.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can mitigate the memory leak vulnerability by avoiding the usage of the IB and qib drivers or disabling the affected functionality. This can be achieved by blacklisting the drivers or modifying the system configuration to prevent their loading. However, it is important to note that this workaround may result in the loss of IB and qib driver functionality, which can impact the performance and capabilities of the system.
Conclusion
The memory leak vulnerability in qib_user_sdma_queue_pkts() can have significant implications for system performance and stability. It is crucial to update the Linux Kernel to version v5.15.12 or later to mitigate this vulnerability. Additionally, users can explore the Vulert Playground at https://vulert.com/scanner to check if their systems are affected by this or other open-source vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability in qib_user_sdma_queue_pkts() can lead to resource exhaustion, degraded system performance, and potential system crashes. It can also be exploited by attackers to cause a denial-of-service (DoS) condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this memory leak vulnerability.
Yes, the memory leak vulnerability in qib_user_sdma_queue_pkts() has been fixed in Linux Kernel version v5.15.12. It is recommended to update the Kernel to this version or later to mitigate the vulnerability.
Yes, as a temporary workaround, you can avoid using the IB and qib drivers or disable the affected functionality by blacklisting the drivers or modifying the system configuration. However, this may result in the loss of IB and qib driver functionality.
You can refer to the vulnerability details in the GSD Database at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002821.json for more information about this memory leak vulnerability in qib_user_sdma_queue_pkts().
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
