Memory Leak Vulnerability in mt76: mt7915
Summary
GSD-2022-1001237: mt76: mt7915: fix possible memory leak in mt7915_mcu_add_sta. Affects Kernel versions >= 89bbd3730f382f15cfcc2c9264c65b5901ce02fa, < b334a245ff1d76b1e97af8cea648ea6798b9eb87. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0 wireless LAN devices. It provides support for various MediaTek wireless chipsets, including the mt7915. The mt7915 is a Wi-Fi 6E chipset that offers high-speed wireless connectivity. However, a vulnerability has been discovered in the mt7915 driver that could lead to a memory leak. This vulnerability could be exploited by an attacker to exhaust system memory, potentially causing a denial-of-service condition or other unexpected behavior.
Vulnerability Detail
The vulnerability in the mt7915 driver is due to a possible memory leak in the mt7915_mcu_add_sta function. When adding a new station (STA) to the driver, there is a potential for memory not being properly freed, leading to a memory leak. This could result in the gradual depletion of system memory over time, potentially causing system instability or crashes. The vulnerability was introduced in version v5.16 of the Linux Kernel and has been fixed in version v5.17.2 by commit b334a245ff1d76b1e97af8cea648ea6798b9eb87.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by disabling the mt7915 driver module. This can be done by blacklisting the module in the Kernel configuration file. To do this, add the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist mt7915
After adding the blacklist entry, reboot the system for the changes to take effect. Note that this workaround will disable the mt7915 functionality until the Kernel is updated with the fix.
Conclusion
The memory leak vulnerability in the mt7915 driver can be mitigated by updating the Linux Kernel to version v5.17.2 or later. Alternatively, a temporary workaround is available by disabling the mt7915 driver module. It is recommended to apply the fix as soon as possible to ensure system stability and security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mt76 is a driver package for MediaTek MT76x0 wireless LAN devices. It provides support for various MediaTek wireless chipsets, including the mt7915.
mt7915 is a Wi-Fi 6E chipset developed by MediaTek. It offers high-speed wireless connectivity and is supported by the mt76 driver package.
The vulnerability could lead to a memory leak in the mt7915 driver, potentially causing system instability, crashes, or denial-of-service conditions.
To fix this vulnerability, update the Linux Kernel to version v5.17.2 or later and rebuild/reinstall the mt76 driver module. Alternatively, you can temporarily disable the mt7915 driver module as a workaround.
Yes, you can temporarily disable the mt7915 driver module by blacklisting it in the Kernel configuration file. This will disable mt7915 functionality until the Kernel is updated with the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
