Memory Leak Vulnerability in net: fec
Summary
UVI-2021-1000546: net: fec: fix the potential memory leak in fec_enet_init(). Affects Kernel versions >= 59d0f746564495c7f54526674deabfcf101236a1, < 32a1777fd113335c3f70dc445dffee0ad1c6870f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: fec package is a component of the Linux Kernel that provides support for the Freescale Fast Ethernet Controller (FEC). It enables network communication over Ethernet connections. The fec_enet_init() function is responsible for initializing the FEC driver. However, a potential memory leak has been identified in this function.
Vulnerability Detail
The memory leak vulnerability in fec_enet_init() can lead to the gradual depletion of system memory resources. When the function is called, memory may be allocated but not properly deallocated, resulting in a memory leak. Over time, this can cause system instability, performance degradation, and potentially denial-of-service conditions. The vulnerability was introduced in version v3.18 of the Linux Kernel and has been fixed in version v5.12.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the memory leak by not using the fec_enet_init() function or the net: fec package. However, this may not be feasible for systems that rely on the functionality provided by the package. It is strongly recommended to apply the fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in net: fec's fec_enet_init() function can lead to memory depletion and system instability. It is crucial to update the Linux Kernel to version v5.12.9 or later to fix this vulnerability. Applying the fix will ensure proper memory deallocation and prevent potential memory leaks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory leaks, which can gradually deplete system memory resources. This can result in system instability, performance degradation, and potentially denial-of-service conditions.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to prevent any potential exploitation.
While updating the Kernel is the recommended solution, you can mitigate the risk by avoiding the use of the fec_enet_init() function or the net: fec package. However, this may not be a feasible workaround for systems that rely on the package's functionality.
You can refer to the Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ for more information about the fix. The vulnerability details can be found in the Open Source Vulnerability database maintained by the Cloud Security Alliance at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000546.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
