mm/kmemleak: Reset Tag When Comparing Object Pointer - Kernel
Summary
GSD-2022-1002125: mm/kmemleak: reset tag when compare object pointer. Affects Kernel versions < d5d5804acc16fce9726fbbd006660d8642e2c459. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and provides an interface for applications to interact with the hardware. It is responsible for memory management, process scheduling, device drivers, and other essential functionalities. The mm/kmemleak subsystem is a part of the Kernel that detects and reports memory leaks in the system. It keeps track of allocated memory objects and identifies any objects that are not freed when they should be. This helps in identifying potential memory leaks and improving system performance. However, a vulnerability has been discovered in the mm/kmemleak subsystem that could lead to security issues.
Vulnerability Detail
The vulnerability in the mm/kmemleak subsystem arises from a failure to reset the tag when comparing object pointers. This can result in incorrect identification of memory objects as leaked when they are actually still in use. An attacker could potentially exploit this vulnerability to cause a denial-of-service condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability has been fixed in Linux Kernel version v5.10.110 by commit d5d5804acc16fce9726fbbd006660d8642e2c459.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The mm/kmemleak vulnerability in the Kernel could potentially lead to security issues, including denial-of-service and arbitrary code execution. It is crucial to update the Kernel to version v5.10.110 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a denial-of-service condition to arbitrary code execution with elevated privileges.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in Linux Kernel version v5.10.110 by commit d5d5804acc16fce9726fbbd006660d8642e2c459.
As there is no specific workaround mentioned, it is recommended to update the Kernel to the fixed version as soon as possible to mitigate the risk.
You can find more information about this vulnerability in the Open Source Vulnerability Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002125.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
