Memory Leak Vulnerability in libbpf
Summary
GSD-2022-1001227: libbpf: Fix memleak in libbpf_netlink_recv(). Affects Kernel versions >= dc69beab5b7baa106d8a195d2c690f7970a81eb5, < c3d665699e872061bdcd014fb462188d66b94b57. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libbpf is a library that provides a user-space API for interacting with the Linux eBPF (extended Berkeley Packet Filter) subsystem. It allows applications to load and manipulate eBPF programs and maps. The library is commonly used in various networking and security-related applications.
Vulnerability Detail
The libbpf library is affected by a memory leak vulnerability in the libbpf_netlink_recv() function. This vulnerability can be exploited by an attacker to cause a denial-of-service condition by repeatedly sending specially crafted netlink messages to the library. The vulnerability was introduced in version v5.17.2 of the Linux Kernel and was fixed in version v5.17.2 by commit c3d665699e872061bdcd014fb462188d66b94b57.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by updating the Linux Kernel.
Conclusion
The libbpf library is affected by a memory leak vulnerability in the libbpf_netlink_recv() function. This vulnerability can be fixed by updating the Linux Kernel to version v5.17.2 or later. There is no known workaround available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
libbpf is a library that provides a user-space API for interacting with the Linux eBPF subsystem. It allows applications to load and manipulate eBPF programs and maps.
This vulnerability can be exploited by an attacker to cause a denial-of-service condition by repeatedly sending specially crafted netlink messages to the libbpf library.
To fix this vulnerability, users should update their Linux Kernel to version v5.17.2 or later. The fix is included in the mentioned commit.
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by updating the Linux Kernel.
Users can obtain the updated Linux Kernel from the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
