Memory Leak Vulnerability in net: caif
Summary
UVI-2021-1000729: net: caif: fix memory leak in caif_device_notify. Affects Kernel versions >= 7c18d2205ea76eef9674e59e1ecae4f332a53e9e, < 4bca2034b41c15b62d47a19158bb76235fd4455d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The net: caif package is a component of the Linux Kernel that provides support for the CAIF (Common Air Interface Framework) protocol. CAIF is a communication protocol used in mobile devices to enable data transfer between the baseband processor and the application processor. The caif_device_notify function in the package is responsible for handling device notifications. However, a memory leak vulnerability has been identified in this function, which could lead to the exhaustion of system resources over time.
Vulnerability Detail
The memory leak vulnerability in net: caif's caif_device_notify function allows an attacker to cause a denial-of-service (DoS) condition by repeatedly triggering device notifications. Each notification triggers a memory allocation that is not properly freed, leading to a gradual depletion of available memory. This can eventually result in system instability or even a complete system crash. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v4.14.236.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the CAIF protocol or avoid triggering device notifications that utilize the caif_device_notify function. However, this may limit the functionality of certain applications or services that rely on CAIF. It is strongly recommended to apply the official fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in net: caif's caif_device_notify function can lead to a gradual depletion of system resources, potentially causing system instability or crashes. It is crucial to update the Linux Kernel to version v4.14.236 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Net: caif is a component of the Linux Kernel that provides support for the CAIF (Common Air Interface Framework) protocol, enabling communication between the baseband processor and the application processor in mobile devices.
The memory leak vulnerability in net: caif can lead to a gradual depletion of system resources, potentially resulting in system instability or a complete system crash.
To fix this vulnerability, update the Linux Kernel to version v4.14.236 or later, which includes the necessary fix for the memory leak issue.
As a temporary workaround, users can disable the CAIF protocol or avoid triggering device notifications that utilize the caif_device_notify function. However, it is recommended to apply the official fix by updating the Linux Kernel.
Users can obtain the updated Linux Kernel from the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
