Memory Leak in mlx5_core_destroy_cq() Error Path in Kernel
Summary
UVI-2021-1002151: net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path. Affects Kernel versions >= e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c, < 94b960b9deffc02fc0747afc01f72cc62ab099e3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the stability and security of the system. The mlx5e module in the Kernel is responsible for handling Mellanox network adapters, specifically the ConnectX-5 Ethernet adapter. This module enables high-performance networking capabilities for applications running on Linux systems.
Vulnerability Detail
The vulnerability identified as UVI-2021-1002151 affects the net/mlx5e module in the Kernel. Specifically, it involves a memory leak issue in the mlx5_core_destroy_cq() function's error path. When an error occurs during the destruction of a Completion Queue (CQ), memory resources are not properly released, leading to a memory leak. This vulnerability could potentially be exploited by an attacker to exhaust system memory, resulting in a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply a patch or backport the fix to their current Kernel version. However, this requires advanced knowledge and understanding of the Kernel codebase. It is recommended to consult official documentation or seek assistance from experienced Kernel developers or administrators for guidance on applying patches or backporting the fix.
Conclusion
In conclusion, the memory leak vulnerability in the mlx5_core_destroy_cq() error path of the net/mlx5e module in the Linux Kernel can potentially lead to a denial-of-service (DoS) condition. It is crucial to update the Kernel to version v5.15 or later to ensure the fix is applied. Applying patches or backporting the fix can also be considered, but it requires advanced knowledge and expertise. For further support and assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to a denial-of-service (DoS) condition by exhausting system memory. However, the actual impact and attack plausibility have not been proven yet.
The vulnerability was introduced in version v3.11 of the Linux Kernel by commit e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c. It is present in all versions between v3.11 and v5.15 (inclusive).
Yes, the vulnerability has been fixed in Linux Kernel version v5.15 and later. It is recommended to update to the latest stable version of the Kernel to ensure the fix is applied.
Yes, it is possible to apply a patch or backport the fix to earlier versions of the Kernel. However, this requires advanced knowledge and understanding of the Kernel codebase. It is recommended to consult official documentation or seek assistance from experienced Kernel developers or administrators for guidance on applying patches or backporting the fix.
You can find more information about this vulnerability, including the source and references, in the Open Source Vulnerability Database (OSVDB) maintained by the Cloud Security Alliance. The specific vulnerability ID is UVI-2021-1002151.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
