Vulnerability in dma-buf/sync_file Package: Fences Leakage on Merge Failure
Summary
UVI-2021-1001256: dma-buf/sync_file: Don't leak fences on merge failure. Affects Kernel versions >= a02b9dc90d844cc7df7b63264e7920cc425052d9, < 0d514185ae792d3a1903c8e1a83899aa996705ce. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dma-buf/sync_file package is a component of the Linux Kernel ecosystem. It provides functionality for sharing memory buffers between different devices and drivers. The package utilizes synchronization files (sync_files) to coordinate access to these shared buffers. Sync_files are used to manage fences, which are synchronization primitives that ensure proper ordering of operations on the shared memory. However, a vulnerability has been discovered in the package that can lead to the leakage of fences in case of a merge failure.
Vulnerability Detail
The vulnerability in the dma-buf/sync_file package allows for the leakage of fences when a merge failure occurs. This can have several implications, including potential resource exhaustion and the possibility of unauthorized access to shared memory. The vulnerability was introduced in version v4.9 of the Linux Kernel and has been fixed in version v5.10.53. The specific commit that addresses this issue is 0d514185ae792d3a1903c8e1a83899aa996705ce. For more technical details, please refer to the references link provided.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the dma-buf/sync_file package in the Linux Kernel is vulnerable to a fences leakage issue on merge failure. This vulnerability can have significant consequences, including resource exhaustion and unauthorized access to shared memory. It is crucial to update the Linux Kernel to version v5.10.53 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dma-buf/sync_file package is a component of the Linux Kernel ecosystem that facilitates the sharing of memory buffers between devices and drivers.
A sync_file is a synchronization file used by the dma-buf/sync_file package to coordinate access to shared memory buffers.
Fences are synchronization primitives utilized by the dma-buf/sync_file package to ensure proper ordering of operations on shared memory.
The vulnerability can result in the leakage of fences, potentially leading to resource exhaustion and unauthorized access to shared memory.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.53 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
