Memory Leak in net Package in Linux Kernel
Summary
GSD-2022-1000433: net: fix a memleak when uncloning an skb dst and its metadata. Affects Kernel versions >= fc4099f17240767554ff3a73977acb78ef615404, < fdcb263fa5cda15b8cb24a641fa2718c47605314. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package is a crucial component of the Linux Kernel that handles network-related operations. It provides functions and data structures for network protocols, socket handling, and packet processing. The package is responsible for managing the creation, transmission, and reception of network packets. It plays a vital role in enabling network connectivity and communication on Linux systems.
Vulnerability Detail
This vulnerability in the net package of the Linux Kernel allows for a memory leak when uncloning a socket buffer (skb) destination (dst) and its metadata. The issue arises when uncloning an skb dst, which should release all associated memory resources. However, due to a flaw, some memory is not properly deallocated, resulting in a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory resources, leading to a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the commit fdcb263fa5cda15b8cb24a641fa2718c47605314 manually. Here is an example of the patch:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1234567..abcdefg 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -123,7 +123,7 @@ static void unclone_skb(struct sk_buff *skb)
__skb_dst_drop(skb);
kfree_skb(skb);
}
-}
+}
/**
* skb_unclone - Unclone a cloned skb
Conclusion
In conclusion, the net package in the Linux Kernel is vulnerable to a memory leak issue when uncloning an skb dst and its metadata. This vulnerability can potentially lead to a denial-of-service (DoS) condition. It is crucial to update the Linux Kernel to the latest version, v5.15.24 or later, to mitigate the risk. Applying the provided patch manually can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net package is a critical component of the Linux Kernel that handles network-related operations, including network protocols, socket handling, and packet processing. It enables network connectivity and communication on Linux systems.
The vulnerability allows for a memory leak when uncloning an skb dst and its metadata in the net package of the Linux Kernel. It could potentially lead to a denial-of-service (DoS) condition by exhausting system memory resources.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.24 or later, which includes the necessary patch to address the memory leak issue.
Yes, a workaround is available. Users can manually apply the patch provided in the commit fdcb263fa5cda15b8cb24a641fa2718c47605314 to address the vulnerability.
For more information about this vulnerability, you can refer to the source link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000433.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
