Memory Leak Vulnerability in nfs Package
Summary
UVI-2021-1001265: nfs: fix acl memory leak of posix_acl_create(). Affects Kernel versions >= 013cdf1088d7235da9477a2375654921d9b9ba9f, < 4b515308ab875c7e8ada8e606fe0c64762da5ed4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nfs package is a component of the Linux Kernel, which is responsible for providing network file system (NFS) functionality. NFS allows remote file systems to be mounted and accessed over a network. It is widely used in distributed computing environments. The vulnerability in the nfs package relates to a memory leak issue in the posix_acl_create() function.
Vulnerability Detail
The posix_acl_create() function in the nfs package has a memory leak vulnerability. This vulnerability was introduced in version v3.14 of the Linux Kernel and was fixed in version v5.10.52. The vulnerability occurs when creating access control lists (ACLs), leading to a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory resources, resulting in denial of service or other adverse effects.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The memory leak vulnerability in the nfs package can be fixed by updating the Linux Kernel to version v5.10.52 or later. It is important to apply the patch to mitigate the risk of denial of service or other adverse effects. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially lead to a denial of service or other adverse effects by exhausting system memory resources.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if the vulnerability is present.
Yes, a patch is available in the Linux Kernel version v5.10.52. It is recommended to update to this version to fix the vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the patch to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over the network.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
