Memory Leak in ceph_readdir in Kernel
Summary
GSD-2022-1001382: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error. Affects Kernel versions < e792575b902a3939ca482491ee9fb3a236f99640. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. One of its features is the ceph_readdir function, which is responsible for reading directory entries in the Ceph distributed file system. However, a vulnerability has been identified in this function that leads to a memory leak when the note_last_dentry function returns an error.
Vulnerability Detail
The vulnerability in ceph_readdir results in a memory leak, which can have various implications. A memory leak occurs when a program fails to release memory that is no longer needed, leading to a gradual depletion of available memory resources. In this case, when the note_last_dentry function encounters an error, the memory allocated for the directory entry is not properly freed, resulting in a memory leak. This can potentially lead to resource exhaustion, system instability, and denial-of-service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually by cherry-picking the specific commit (e792575b902a3939ca482491ee9fb3a236f99640) into their Kernel source code and recompiling the Kernel. Here is an example of how to apply the patch using the 'git cherry-pick' command:
$ git cherry-pick e792575b902a3939ca482491ee9fb3a236f99640
After applying the patch, rebuild and reinstall the Kernel to ensure the fix is in effect.
Conclusion
In conclusion, the ceph_readdir function in the Kernel is vulnerable to a memory leak issue when the note_last_dentry function returns an error. This vulnerability can have serious consequences, including resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v5.16.20 or later to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a memory leak, leading to resource exhaustion, system instability, and potential denial-of-service attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a workaround is available. Users can manually apply the patch by cherry-picking the specific commit (e792575b902a3939ca482491ee9fb3a236f99640) into their Kernel source code and recompiling the Kernel.
The recommended solution is to update the Linux Kernel to version v5.16.20 or later, which includes the fix for this vulnerability.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001382.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
