Memory Leak Vulnerability in fsl_ifc Package
Summary
UVI-2021-1001474: memory: fsl_ifc: fix leak of IO mapping on probe failure. Affects Kernel versions >= a20cbdeffce247a2b6fb83cd8d22433994068565, < b7a2bcb4a3731d68f938207f75ed3e1d41774510. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fsl_ifc package is a memory management component in the Linux Kernel. It provides functionality for handling input/output (IO) mappings. IO mappings are essential for managing memory resources efficiently. However, a vulnerability has been discovered in the fsl_ifc package that can lead to a memory leak when the probe process fails. This vulnerability can potentially impact the stability and performance of the system.
Vulnerability Detail
The vulnerability in the fsl_ifc package occurs when the probe process fails. In such cases, the IO mapping is not properly released, resulting in a memory leak. This can lead to a gradual depletion of available memory resources, potentially causing system instability and performance degradation. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v4.4.276.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually release the IO mapping in case of probe failure. This can be done by implementing proper error handling in the code that utilizes the fsl_ifc package. Here is an example of how the IO mapping can be released:
void release_io_mapping(struct fsl_ifc_device *dev) {
if (dev->io_mapping) {
iounmap(dev->io_mapping);
dev->io_mapping = NULL;
}
}
By calling the release_io_mapping function when the probe process fails, the IO mapping will be properly released, preventing the memory leak.
Conclusion
The memory leak vulnerability in the fsl_ifc package can lead to system instability and performance degradation due to the gradual depletion of available memory resources. It is crucial to update the Linux Kernel to version v4.4.276 or later to fix this vulnerability. Additionally, implementing proper error handling and manually releasing the IO mapping in case of probe failure can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a memory leak, leading to gradual depletion of available memory resources. This can cause system instability and performance degradation.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this memory leak vulnerability in the fsl_ifc package.
Yes, the vulnerability has been fixed in version v4.4.276 of the Linux Kernel. It is recommended to update your Kernel to this version or later to address the memory leak issue in the fsl_ifc package.
Yes, as a workaround, you can manually release the IO mapping in case of probe failure. Implement proper error handling in your code that utilizes the fsl_ifc package and call the release_io_mapping function to release the IO mapping.
You can find more information about this vulnerability in the Open Source Vulnerability Database. The vulnerability ID is UVI-2021-1001474. You can access the details of this vulnerability at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/UVI-2021-1001474.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
