Memory Leak in smsc75xx_bind in Kernel
Summary
UVI-2021-1000663: net: usb: fix memory leak in smsc75xx_bind. Affects Kernel versions >= d0cad871703b898a442e4049c532ec39168e5b57, < 9e6a3eccb28779710cbbafc4f4258d92509c6d07. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that manages core system functions, including hardware communication. It provides an interface between the hardware and software layers, allowing applications to access system resources. The smsc75xx_bind function in the Kernel's USB network driver is responsible for binding a USB device to the network stack. However, a memory leak vulnerability has been identified in this function, which could lead to the exhaustion of system memory resources over time.
Vulnerability Detail
The memory leak vulnerability in smsc75xx_bind arises from a failure to release allocated memory when binding a USB device to the network stack. This can result in a gradual depletion of available memory, potentially leading to system instability or denial of service. The vulnerability was introduced in version v2.6.34 of the Linux Kernel and affects all subsequent versions until v4.19.193. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can unload and reload the USB network driver module to release the allocated memory. This can be achieved by executing the following commands:
modprobe -r smsc75xx
modprobe smsc75xx
These commands will unload and reload the smsc75xx module, effectively freeing up the memory resources. However, it is important to note that this is a temporary solution and updating the Kernel is still recommended for a permanent fix.
Conclusion
In conclusion, a memory leak vulnerability has been identified in the smsc75xx_bind function of the Kernel's USB network driver. This vulnerability can lead to the gradual depletion of system memory resources, potentially causing system instability or denial of service. To address this issue, it is recommended to update the Linux Kernel to version v4.19.193 or later. A temporary workaround is available by unloading and reloading the USB network driver module, but updating the Kernel is still the recommended course of action. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a gradual depletion of system memory resources, potentially causing system instability or denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for open-source vulnerabilities, including this specific issue.
Yes, a temporary workaround is to unload and reload the USB network driver module. This can be done by executing the commands 'modprobe -r smsc75xx' and 'modprobe smsc75xx'. However, updating the Kernel is still recommended for a permanent fix.
The vulnerability was introduced in version v2.6.34 of the Linux Kernel and affects all subsequent versions until v4.19.193.
There is no evidence of this vulnerability being exploited in the wild at this time. However, it is still important to apply the recommended fix to ensure system security.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
