Memory Leak in RDMA/cma in Linux Kernel
Summary
UVI-2021-1001219: RDMA/cma: Fix rdma_resolve_route() memory leak. Affects Kernel versions < 07583ba2e2d8947c3d365d97608cb436510885ac. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential services to applications. RDMA (Remote Direct Memory Access) is a protocol that allows direct memory access from the memory of one computer to the memory of another computer without involving the operating system. RDMA/cma (RDMA Connection Manager) is a component of the Linux Kernel that provides the infrastructure for establishing and managing RDMA connections.
This vulnerability, identified as UVI-2021-1001219, is a memory leak in the rdma_resolve_route() function of RDMA/cma. The function fails to release allocated memory in certain scenarios, leading to a memory leak. This vulnerability could be exploited by an attacker to exhaust system memory resources, potentially causing a denial-of-service condition or other adverse effects.
Vulnerability Detail
The vulnerability arises from a memory leak in the rdma_resolve_route() function of RDMA/cma. When this function is called to resolve the route for an RDMA connection, it may allocate memory but fail to release it under specific conditions. As a result, each invocation of rdma_resolve_route() without proper memory deallocation will consume additional memory, eventually leading to memory exhaustion.
The impact of this vulnerability could vary depending on the system's available memory and the frequency of rdma_resolve_route() invocations. In worst-case scenarios, it could result in a denial-of-service condition, causing the system to become unresponsive or crash. Additionally, the memory leak could potentially be leveraged in combination with other vulnerabilities to facilitate more sophisticated attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can mitigate the impact of this vulnerability by limiting the usage of the rdma_resolve_route() function or avoiding its use altogether, if possible. By minimizing the frequency of invocations or employing alternative methods for route resolution, the memory leak can be mitigated. However, this workaround may not be feasible in all scenarios and could impact the functionality or performance of RDMA-based applications.
Conclusion
The memory leak vulnerability in RDMA/cma's rdma_resolve_route() function can have serious consequences, including denial-of-service and system instability. It is crucial to update the Linux Kernel to a version that includes the fix to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential services to applications.
RDMA (Remote Direct Memory Access) is a protocol that allows direct memory access from the memory of one computer to the memory of another computer without involving the operating system.
RDMA/cma (RDMA Connection Manager) is a component of the Linux Kernel that provides the infrastructure for establishing and managing RDMA connections.
The vulnerability can lead to a memory leak, potentially causing a denial-of-service condition or other adverse effects. The severity of the impact depends on the system's available memory and the frequency of rdma_resolve_route() invocations.
To fix the vulnerability, update your Linux Kernel installation to at least version v5.13.3 or any subsequent release that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
