Memory Leak in RDMA/cma in Linux Kernel
Summary
UVI-2021-1001428: RDMA/cma: Fix rdma_resolve_route() memory leak. Affects Kernel versions < e4e062da082a199357ba4911145f331d40139ad8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential services to applications. RDMA (Remote Direct Memory Access) is a technology that allows direct memory access from the memory of one computer to the memory of another computer without involving the operating system. RDMA/cma (RDMA Connection Manager) is a component of the Linux Kernel that provides APIs for managing RDMA connections.
The vulnerability identified as UVI-2021-1001428 in the RDMA/cma component of the Linux Kernel can lead to a memory leak. A memory leak occurs when a program fails to release memory it no longer needs, resulting in the gradual depletion of available memory resources. This vulnerability can potentially be exploited to exhaust system memory, leading to performance degradation or even system crashes.
Vulnerability Detail
The vulnerability in RDMA/cma, tracked as UVI-2021-1001428, is caused by a memory leak in the rdma_resolve_route() function. This function is responsible for resolving the route for an RDMA connection. However, due to a coding error, memory allocated during the route resolution process is not properly freed, resulting in a memory leak.
An attacker could potentially exploit this vulnerability by repeatedly establishing and tearing down RDMA connections, causing the memory leak to accumulate over time. This could lead to a denial-of-service (DoS) condition by exhausting system memory resources.
The vulnerability has been fixed in the Linux Kernel version v4.14.240 by commit e4e062da082a199357ba4911145f331d40139ad8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in RDMA/cma in the Linux Kernel can lead to a gradual depletion of system memory resources. It is recommended to update the Linux Kernel to version v4.14.240 or later to fix this vulnerability. Users can also utilize the Vulert Playground at https://vulert.com/scanner to check if their system is affected and receive real-time alerts for open-source vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a memory leak in the RDMA/cma component of the Linux Kernel. It can potentially be exploited to exhaust system memory, causing performance degradation or system crashes.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities, including UVI-2021-1001428, are detected.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix to prevent potential exploitation.
Yes, this vulnerability can be remotely exploited by an attacker who can establish and tear down RDMA connections to trigger the memory leak.
The only effective mitigation for this vulnerability is to apply the fix by updating the Linux Kernel to version v4.14.240 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
