Memory Leak in net: mdiobus_register
Summary
UVI-2021-1001777: net: mdiobus: Fix memory leak in __mdiobus_register. Affects Kernel versions < bc5f2f3431ced08300e4cb3aff35f1da14c26433. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The net package in the Linux Kernel provides networking functionality, including the management of network devices. The mdiobus_register function within the package is responsible for registering a Media Independent Interface (MII) bus. The MII bus is used to connect network devices, such as Ethernet controllers, to the system. This vulnerability in the mdiobus_register function can lead to a memory leak, potentially causing resource exhaustion and system instability.
Vulnerability Detail
The vulnerability arises from a memory leak in the __mdiobus_register function within the net package. When registering an MII bus, the function fails to release allocated memory in certain scenarios, resulting in a memory leak. An attacker could potentially exploit this vulnerability by repeatedly registering MII buses, leading to resource exhaustion and denial-of-service conditions. The impact of this vulnerability depends on the specific usage of the net package and the system's susceptibility to resource exhaustion attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by limiting the registration of MII buses to only necessary instances. By carefully managing the registration process and avoiding excessive registrations, the risk of resource exhaustion due to the memory leak can be mitigated.
Conclusion
The memory leak vulnerability in the net package's __mdiobus_register function can have serious consequences, including resource exhaustion and system instability. It is crucial to update the Linux Kernel to the patched version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net package in the Linux Kernel provides networking functionality and manages network devices.
The mdiobus_register function is responsible for registering a Media Independent Interface (MII) bus, which connects network devices to the system.
A memory leak occurs when allocated memory is not properly released, leading to a gradual depletion of available memory resources.
The vulnerability can result in resource exhaustion and system instability, potentially leading to denial-of-service conditions.
To fix this vulnerability, update the Linux Kernel to version v4.9.288 or later, which includes the necessary patch.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
