Vulnerability in mxser package: xmit_buf leak in activate when LSR == 0xff
Summary
GSD-2022-1002431: mxser: fix xmit_buf leak in activate when LSR == 0xff. Affects Kernel versions >= 6769140d304731f0a3b177470a2adb4bacd9036b, < 125b7c929fc9b1e5eaa344bceb6367dfa6fd3f9d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mxser package is a part of the Linux Kernel ecosystem. It provides support for serial communication through multiport serial cards. The package allows users to connect and communicate with external devices using serial ports. The vulnerability in the mxser package relates to a memory leak issue in the activate function when the Line Status Register (LSR) is equal to 0xff.
Vulnerability Detail
The vulnerability in the mxser package can lead to a memory leak when the LSR is set to 0xff during the activation process. This can result in the consumption of excessive memory resources, potentially leading to system instability or denial of service. The issue was introduced in version v2.6.33 of the Linux Kernel and has been fixed in version v4.14.276. The vulnerability is tracked under the ID GSD-2022-1002431.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerability by ensuring that the LSR value is not set to 0xff during the activation process. This can be achieved by modifying the relevant code that interacts with the mxser package to handle the LSR value appropriately.
Conclusion
The mxser package in the Linux Kernel is vulnerable to a memory leak issue when the LSR value is set to 0xff during activation. This vulnerability has been fixed in version v4.14.276 of the Linux Kernel. Users are advised to update their kernel to this version or a later one to ensure the security and stability of their systems. For further assistance or information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The mxser package is a component of the Linux Kernel that provides support for multiport serial cards and enables serial communication with external devices.
The vulnerability can result in a memory leak, leading to excessive memory consumption and potentially causing system instability or denial of service.
The vulnerability was introduced in version v2.6.33 of the Linux Kernel and is present in all versions prior to v4.14.276.
Yes, the vulnerability has been fixed in version v4.14.276 of the Linux Kernel. Users are advised to update to this version or a later one to mitigate the issue.
For more details about the vulnerability, you can refer to the source link provided in the Open Source Vulnerability format or contact info@devnack.com for further support.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
