Memory Leak in RDMA/mlx5 Subscribe Event Routine
Summary
GSD-2022-1002242: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine. Affects Kernel versions >= 7597385371425febdaa8c6a1da3625d4ffff16f5, < 0174a89663a5ef83617da15bf24c0af2f62b6c7f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RDMA/mlx5 package is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. RDMA allows for high-speed data transfer between remote systems with low latency. The mlx5 driver is responsible for managing the Mellanox ConnectX-4 and ConnectX-5 adapters. This vulnerability affects versions 5.3 to 5.4.188 of the Linux Kernel.
Vulnerability Detail
The vulnerability in RDMA/mlx5 is a memory leak that occurs in the error flow for the subscribe event routine. When an error is encountered during the event subscription process, memory allocated for the event subscription is not properly freed, leading to a memory leak. This can result in the exhaustion of system memory resources over time, potentially leading to system instability or denial of service. The vulnerability was introduced in version 5.3 of the Linux Kernel and was fixed in version 5.4.189.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
Conclusion
In conclusion, the RDMA/mlx5 package in the Linux Kernel is vulnerable to a memory leak in the error flow for the subscribe event routine. This vulnerability can lead to the exhaustion of system memory resources over time, potentially causing system instability or denial of service. It is recommended to update the Linux Kernel to version 5.4.189 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
RDMA/mlx5 is a component of the Linux Kernel that provides support for Remote Direct Memory Access (RDMA) over Mellanox ConnectX-4 and ConnectX-5 Ethernet adapters. It allows for high-speed data transfer between remote systems with low latency.
The vulnerability can lead to a memory leak, which can result in the exhaustion of system memory resources over time. This can potentially lead to system instability or denial of service.
To fix this vulnerability, it is recommended to update the Linux Kernel to version 5.4.189 or later. This can be done by downloading the latest stable version of the Linux Kernel from the official repository and following the installation instructions provided.
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
Versions 5.3 to 5.4.188 of the Linux Kernel are affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
