Memory Leak Vulnerability in virt: acrn
Summary
GSD-2022-1001809: virt: acrn: fix a memory leak in acrn_dev_ioctl(). Affects Kernel versions >= 9c5137aedd112f78a968bdd2325de2ea06df46c0, < 1d5103d9bb7d42fc220afe9f01ec6b9fe0ea5773. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The virt: acrn package is a component of the Linux Kernel ecosystem. It provides virtualization support for the ACRN hypervisor. The ACRN hypervisor is designed for safety-critical real-time systems and Internet of Things (IoT) devices. It allows for the isolation and management of multiple virtual machines on a single physical machine. However, a memory leak vulnerability has been discovered in the acrn_dev_ioctl() function of the virt: acrn package.
Vulnerability Detail
The memory leak vulnerability in acrn_dev_ioctl() can lead to the exhaustion of system memory resources over time. This can result in degraded system performance and potentially a denial-of-service (DoS) condition. The vulnerability is triggered when the acrn_dev_ioctl() function is called with certain parameters, causing it to allocate memory that is not properly freed. Attackers may be able to exploit this vulnerability to consume excessive memory resources, leading to system instability or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by updating the Linux Kernel to the recommended version.
Conclusion
The memory leak vulnerability in virt: acrn's acrn_dev_ioctl() function can result in memory exhaustion and potential system instability. It is crucial to update the Linux Kernel to version v5.15.33 or later to fix this vulnerability. No known workarounds exist, and it is recommended to apply the provided fix as soon as possible. For additional support, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory exhaustion, resulting in degraded system performance and potential denial-of-service (DoS) conditions.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be remotely exploited if an attacker can send malicious requests to the affected system, triggering the acrn_dev_ioctl() function with the specific parameters that lead to the memory leak.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
