Vulnerability in mm/mempolicy Package: mpol_new Leak in shared_policy_replace
Summary
GSD-2022-1002305: mm/mempolicy: fix mpol_new leak in shared_policy_replace. Affects Kernel versions >= 42288fe366c4f1ce7522bc9f27d0bc2a81c55264, < 39a32f3c06f6d68a530bf9612afa19f50f12e93d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mm/mempolicy package is a component of the Linux Kernel, which is responsible for managing memory policies in the system. It provides functionality for controlling the allocation of memory resources based on policies defined by the user or the system. The shared_policy_replace function in this package is vulnerable to a memory leak issue, which can lead to resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from a memory leak in the shared_policy_replace function of the mm/mempolicy package. This function is used to replace the shared memory policy of a process. However, due to a coding error, the function fails to release the memory allocated for the new policy (mpol_new) in certain scenarios. As a result, each invocation of shared_policy_replace without a subsequent cleanup can cause a small memory leak. If an attacker can repeatedly trigger this vulnerability, they may be able to exhaust the available memory resources, leading to a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid the memory leak by ensuring that the shared_policy_replace function is called with a subsequent cleanup step to release the allocated memory for the new policy (mpol_new). This can be achieved by modifying the code to include the necessary cleanup logic after invoking the shared_policy_replace function.
Conclusion
In conclusion, the mm/mempolicy package in the Linux Kernel is vulnerable to a memory leak issue in the shared_policy_replace function. This vulnerability can potentially lead to resource exhaustion and denial-of-service attacks. To mitigate the risk, it is recommended to update the Linux Kernel to version v4.19.238 or later. Additionally, users can implement the temporary workaround mentioned in this report. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to resource exhaustion and denial-of-service attacks if an attacker can repeatedly trigger the memory leak in the shared_policy_replace function.
The vulnerability was introduced in version v3.8 of the Linux Kernel by commit 42288fe366c4f1ce7522bc9f27d0bc2a81c55264. It is fixed in version v4.19.238 and later.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to prevent potential exploitation.
The recommended mitigation is to update the Linux Kernel to version v4.19.238 or later. Additionally, users can implement the temporary workaround mentioned in the 'workaround' section of this report.
For more information about this vulnerability, you can refer to the source link provided in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
