Memory Leak Vulnerability in yam Package
Summary
GSD-2022-1000202: yam: fix a memory leak in yam_siocdevprivate(). Affects Kernel versions >= 0781168e23a2fc8dceb989f11fc5b39b3ccacc35, < 729e54636b3ebefb77796702a5b1f1ed5586895e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yam package is a component of the Linux Kernel, which is responsible for managing network interfaces. It provides functionality for configuring and controlling network devices. The yam_siocdevprivate() function in the yam package is vulnerable to a memory leak issue. This vulnerability can be exploited by an attacker to exhaust system memory resources, potentially leading to a denial of service (DoS) condition.
Vulnerability Detail
The memory leak vulnerability in yam_siocdevprivate() arises from a failure to release allocated memory under certain conditions. When this function is called, it may allocate memory for internal data structures but fails to free it properly before returning. As a result, each invocation of yam_siocdevprivate() without proper cleanup can lead to a small memory leak. If an attacker can repeatedly trigger this function without allowing the system to reclaim the leaked memory, it can eventually consume all available memory resources, causing the system to become unresponsive or crash.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerable function by disabling or limiting the use of network interfaces that rely on the yam package. However, this may not be a feasible solution for systems heavily dependent on network functionality.
Conclusion
The memory leak vulnerability in the yam package can be addressed by updating the Linux Kernel to version v5.10.96 or later. This fix ensures that allocated memory is properly released, preventing potential denial of service (DoS) conditions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, potentially causing a denial of service (DoS) condition by exhausting system memory resources.
An attacker can repeatedly trigger the vulnerable function, causing memory leaks and eventually consuming all available memory resources, leading to system unresponsiveness or crashes.
At the time of this report, there is no known public exploit available for this vulnerability.
The vulnerability was introduced in version v4.19 of the Linux Kernel and is present in all versions up to v5.10.95. It has been fixed in version v5.10.96 and later.
Updating the Linux Kernel to the fixed version is the recommended mitigation. Additionally, limiting the use of network interfaces relying on the yam package can reduce the attack surface.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
