Memory Leak in RDMA/mlx5
Summary
GSD-2022-1001521: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine. Affects Kernel versions >= 7597385371425febdaa8c6a1da3625d4ffff16f5, < d66498507801fd9a20307a15a0814a0a016c3cde. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RDMA/mlx5 is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. RDMA allows for high-speed, low-latency data transfers between remote systems. The mlx5 driver is responsible for managing the Mellanox ConnectX-4 and ConnectX-5 adapters. This vulnerability in the RDMA/mlx5 component leads to a memory leak in the error flow for the subscribe event routine.
Vulnerability Detail
The vulnerability in RDMA/mlx5 results in a memory leak when an error occurs in the subscribe event routine. This can lead to a gradual depletion of system memory, potentially causing performance degradation or even system instability. The issue was introduced in version v5.3 of the Linux Kernel and is fixed in version v5.16.19. The vulnerability can be exploited by an attacker with local access to the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Conclusion
The memory leak vulnerability in RDMA/mlx5 can be fixed by updating the Linux Kernel to version v5.16.19 or later. It is important to promptly apply the necessary updates to ensure system stability and prevent potential performance degradation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
RDMA/mlx5 is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. It allows for high-speed, low-latency data transfers between remote systems.
The vulnerability can lead to a memory leak in the error flow for the subscribe event routine in RDMA/mlx5. This can result in a gradual depletion of system memory, potentially causing performance degradation or system instability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.19 or later. This can be done by downloading the latest stable version of the Linux Kernel from the official repository and following the installation instructions provided.
There is no specific workaround available for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
No, this vulnerability requires local access to the affected system to be exploited.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
