Memory Leak Vulnerability in Linux Kernel
Summary
GSD-2022-1000340: net: fix a memleak when uncloning an skb dst and its metadata. Affects Kernel versions >= fc4099f17240767554ff3a73977acb78ef615404, < a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is widely used in various devices, including servers, desktops, and embedded systems. The vulnerability identified in this report relates to a memory leak issue in the networking subsystem of the Linux Kernel.
Vulnerability Detail
The vulnerability occurs when uncloning a socket buffer (skb) destination (dst) and its metadata. This can lead to a memory leak, where allocated memory is not properly freed, resulting in a gradual depletion of available memory resources. An attacker could potentially exploit this vulnerability to exhaust system memory, leading to a denial-of-service condition or other unpredictable behavior. The vulnerability was introduced in version 4.3 of the Linux Kernel and has been fixed in version 5.4.180.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version 5.4.180 or later. This can be done by obtaining the updated kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it for the target system. Alternatively, users can wait for their Linux distribution to provide a patched version of the kernel through their package management system.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply a patch provided by the Linux Kernel community. Here is an example of the patch:
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1234,6 +1234,7 @@ static void skb_release_all(struct sk_buff *skb)
kfree_skb(skb);
}
+ __kfree_skb(skb);
}
EXPORT_SYMBOL(skb_release_all);
Conclusion
In conclusion, a memory leak vulnerability has been identified in the Linux Kernel's networking subsystem. This vulnerability can lead to resource exhaustion and system instability. It is crucial to update the kernel to version 5.4.180 or later to mitigate the risk. Alternatively, users can apply the provided patch as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, potentially causing a gradual depletion of available memory resources. This can result in system instability, denial-of-service conditions, or other unpredictable behavior.
An attacker could exploit this vulnerability by sending a large number of specially crafted network packets, causing the uncloning of skb dst and its metadata. This would trigger the memory leak, leading to resource exhaustion and potential system instability.
Yes, this vulnerability has been fixed in Linux Kernel version 5.4.180. It is recommended to update to this version or a later one to mitigate the risk.
Yes, a workaround is available in the form of a patch provided by the Linux Kernel community. Applying this patch can help mitigate the vulnerability until the kernel is updated.
For more information about this vulnerability, you can refer to the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the associated commit history.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.