Memory Leak in sideband_msg_req_encode_decode in Kernel
Summary
GSD-2022-1001554: drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode_decode. Affects Kernel versions >= 09234b88ef5598252d1cee37e4d7b26a48b6557f, < 3ee7db7ea79bd318614a5ce5bcbbab4b7976ff98. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in question affects the Kernel's drm/selftests/test-drm_dp_mst_helper module, which is responsible for testing the DisplayPort Multi-Stream Transport (MST) helper functions. The MST functionality allows multiple displays to be connected through a single DisplayPort connection. This vulnerability specifically pertains to the sideband_msg_req_encode_decode function within the test-drm_dp_mst_helper module.
Vulnerability Detail
The sideband_msg_req_encode_decode function in the test-drm_dp_mst_helper module of the Kernel suffers from a memory leak issue. When encoding and decoding sideband message requests, the function fails to release allocated memory, leading to a gradual depletion of system resources. If an attacker can trigger this vulnerability by sending specially crafted sideband messages, it could result in a denial of service (DoS) condition or potentially allow for the execution of arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is essential to update the Kernel to the patched version as soon as possible.
Conclusion
The memory leak vulnerability in the sideband_msg_req_encode_decode function of the Kernel's drm/selftests/test-drm_dp_mst_helper module can potentially lead to a denial of service (DoS) condition or arbitrary code execution. It is crucial to update the Kernel to the fixed version (v5.16.19) to mitigate this vulnerability. Regularly checking for Kernel updates and promptly applying them is recommended to ensure system security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a denial of service (DoS) condition to the potential execution of arbitrary code. However, the actual impact and attack plausibility have not been proven yet.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply upload your package-lock.json file to the playground, and it will provide information on any vulnerabilities present.
Yes, the vulnerability has been fixed in Linux Kernel version v5.16.19 by commit 3ee7db7ea79bd318614a5ce5bcbbab4b7976ff98. It is recommended to update your Kernel to the latest version to address this issue.
No, there are no known workarounds available for this vulnerability. Updating the Kernel to the patched version is the recommended solution.
You can find more information about this vulnerability in the GSD-2022-1001554 JSON report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001554.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
