Memory Leak in vmbus_add_channel_kobj in Linux Kernel
Summary
GSD-2022-1000358: Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj. Affects Kernel versions >= c2e5df616e1ae6c2a074cb241ebb65a318ebaf7c, < fe595759c2a4a5bb41c438474f15947d8ae32f5c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for software to interact with the hardware. The vmbus subsystem in the Kernel is used for communication between the host and virtual machines in a Hyper-V environment. The vmbus_add_channel_kobj function is responsible for adding a sysfs entry for a vmbus channel. However, a memory leak vulnerability exists in this function, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The memory leak vulnerability in vmbus_add_channel_kobj allows an attacker to continuously allocate memory resources without freeing them, leading to resource exhaustion. This can result in system instability, denial of service, or potential privilege escalation if the attacker can control the allocation size. The vulnerability was introduced in Linux Kernel version 4.15 and is fixed in version 5.4.181. The impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The memory leak vulnerability in vmbus_add_channel_kobj in the Linux Kernel can lead to resource exhaustion and system instability. It is crucial to update the Kernel to version 5.4.181 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion, system instability, denial of service, or potential privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the playground will analyze it for any open-source vulnerabilities, including this one.
There is no known exploit for this vulnerability at the moment. However, it is always recommended to apply security patches and updates to mitigate potential risks.
The vulnerability itself does not provide remote exploitation capabilities. However, if an attacker already has access to the system, they can potentially leverage this vulnerability for privilege escalation or denial of service attacks.
If updating the Kernel is not immediately feasible, it is recommended to implement other security measures such as network segmentation, access controls, and monitoring to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
