Memory Leak in samples/landlock Package
Summary
GSD-2022-1001595: samples/landlock: Fix path_list memory leak. Affects Kernel versions < 49b0d8bf05809df5f87e5c03e26d74bdfdab4571. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The samples/landlock package is a part of the Linux Kernel ecosystem. It provides a set of sample programs and utilities for demonstrating the usage of the Landlock security module in the Linux Kernel. Landlock is a security feature that allows fine-grained access control policies for processes. It restricts the access of processes to specific files and directories based on defined rules. However, a memory leak vulnerability has been identified in the path_list component of the samples/landlock package.
Vulnerability Detail
The memory leak vulnerability in the samples/landlock package can lead to excessive memory consumption when manipulating path lists. This vulnerability can be exploited by an attacker to exhaust system resources, potentially resulting in a denial-of-service (DoS) condition. The vulnerability arises due to a failure to release allocated memory when manipulating path lists. As a result, each manipulation operation adds to the memory usage, eventually leading to resource exhaustion. This vulnerability has been assigned the ID GSD-2022-1001595 and has been fixed in Linux Kernel version v5.16.19 by commit 49b0d8bf05809df5f87e5c03e26d74bdfdab4571.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the samples/landlock package in the Linux Kernel ecosystem is affected by a memory leak vulnerability. This vulnerability can lead to excessive memory consumption and potential denial-of-service (DoS) conditions. It is crucial to update the Linux Kernel to version v5.16.19 or later, which includes the fix for this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability in the samples/landlock package can lead to excessive memory consumption, potentially resulting in a denial-of-service (DoS) condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities, including this memory leak vulnerability, are found.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
As of now, there are no known exploits for this vulnerability. However, it is crucial to apply the fix to prevent potential resource exhaustion and mitigate the risk of a denial-of-service (DoS) attack.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability entry can be accessed at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001595.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
