Memory Leak in mt76: mt7615
Summary
UVI-2021-1000347: mt76: mt7615: fix memleak when mt7615_unregister_device(). Affects Kernel versions >= aec5719681405af21102c2407b01f83ed19e9833, < 4fa28c807da54c1d720b3cc12e48eb9bea1e2c8f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, and MT7663 wireless LAN chipsets. It provides support for these chipsets in the Linux kernel. The mt7615 module within the mt76 package is responsible for managing the MT7615 chipset. This chipset is commonly found in Wi-Fi routers and other networking devices. The vulnerability in question is related to memory management within the mt7615 module.
Vulnerability Detail
The vulnerability, identified as UVI-2021-1000347, is a memory leak issue that occurs when unregistering the mt7615 device. The memory leak is triggered by a failure to release allocated memory resources during the device unregister process. An attacker could potentially exploit this vulnerability by repeatedly registering and unregistering mt7615 devices, leading to a gradual depletion of system memory. This could result in system instability, performance degradation, or even a denial-of-service condition. The vulnerability was introduced in Linux Kernel version v5.10.21 and has been fixed in version v5.10.37.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the kernel is not immediately feasible, a temporary workaround can be implemented to mitigate the vulnerability. The workaround involves avoiding the repeated registration and unregistration of mt7615 devices. By minimizing device registration and unregistration operations, the potential for memory leaks can be reduced. However, this workaround is not a permanent solution and should be considered temporary until the kernel update can be applied.
Conclusion
In conclusion, the memory leak vulnerability in the mt76 mt7615 module can be mitigated by updating the Linux Kernel to version v5.10.37 or later. This update includes the necessary fix to prevent memory leaks during device unregistration. If immediate kernel update is not possible, a temporary workaround can be implemented by minimizing device registration and unregistration operations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, and MT7663 wireless LAN chipsets in the Linux kernel.
The vulnerability can lead to memory leaks, which may result in system instability, performance degradation, or denial-of-service conditions.
To fix this vulnerability, update the Linux Kernel to version v5.10.37 or later.
Yes, a temporary workaround is to minimize device registration and unregistration operations for mt7615 devices.
The updated Linux Kernel can be obtained from the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
