Memory Leak in mkiss_close in Kernel
Summary
UVI-2021-1000989: net: hamradio: fix memory leak in mkiss_close. Affects Kernel versions >= 815f62bf742718458ba822a7e1f51f285eb997f2, < 290b0b6432e2599021db0b8d6046f756d931c29f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces between hardware and software. It is responsible for managing system resources, including memory, processes, and device drivers. The mkiss_close function is part of the hamradio network subsystem in the Kernel, which handles communication over amateur radio protocols. This vulnerability specifically affects the mkiss_close function, leading to a memory leak.
Vulnerability Detail
The mkiss_close function in the hamradio network subsystem of the Kernel suffers from a memory leak. When this function is called to close a mkiss device, it fails to release allocated memory, resulting in a gradual depletion of system resources. An attacker could potentially exploit this vulnerability to exhaust available memory, leading to system instability or denial of service. The vulnerability was introduced in Kernel version 2.6.14 and is fixed in version 5.10.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected hamradio network subsystem or disable the mkiss functionality if not required. This can be achieved by unloading the corresponding Kernel module or blacklisting it to prevent it from being loaded during system startup. The specific steps to perform this workaround may vary depending on the Linux distribution and the system's configuration.
Conclusion
The memory leak vulnerability in the mkiss_close function of the hamradio network subsystem in the Kernel can lead to system instability or denial of service. It is crucial to update the Linux Kernel to version 5.10.46 or later to fix this vulnerability. Users can also employ temporary workarounds, such as avoiding the affected subsystem or disabling the mkiss functionality. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a gradual depletion of system resources, potentially causing system instability or denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fixes to mitigate any potential risks.
No, this vulnerability requires local access to the system in order to exploit it.
The recommended solution is to update the Linux Kernel to the fixed version. However, if updating the Kernel is not feasible, you can consider implementing strict resource limits or monitoring mechanisms to detect and mitigate excessive resource consumption.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
