Memory Leak in kfence Objects in Linux Kernel
Summary
GSD-2021-1002838: kfence: fix memory leak when cat kfence objects. Affects Kernel versions >= 0ce20dd840897b12ae70869c69f1ba34d6d16965, < 2f06c8293d27f6337f907042c602c9c953988c48. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. kfence is a kernel feature that helps detect and prevent use-after-free bugs by poisoning freed objects. However, a memory leak vulnerability has been discovered in kfence when concatenating kfence objects.
Vulnerability Detail
The vulnerability in kfence allows an attacker to trigger a memory leak when concatenating kfence objects. This can lead to a depletion of system memory resources, potentially causing denial-of-service conditions or other unexpected behavior. The vulnerability was introduced in Linux Kernel version 5.12 and has been fixed in version 5.15.12. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The memory leak vulnerability in kfence objects in the Linux Kernel can be mitigated by updating to version 5.15.12 or later. It is important to keep the kernel up to date to ensure the security and stability of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
kfence is a kernel feature that helps detect and prevent use-after-free bugs by poisoning freed objects. It adds additional metadata to kernel objects to detect invalid accesses.
The vulnerability can lead to a memory leak, potentially causing denial-of-service conditions or other unexpected behavior due to the depletion of system memory resources.
You can check the version of your Linux Kernel using the 'uname -r' command. If your kernel version is earlier than 5.15.12, it may be affected by this vulnerability.
No known exploit has been reported for this vulnerability at the moment.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) with the ID GSD-2021-1002838.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
