Vulnerability in mm/mempolicy package: mpol_new leak in shared_policy_replace
Summary
GSD-2022-1002469: mm/mempolicy: fix mpol_new leak in shared_policy_replace. Affects Kernel versions >= 42288fe366c4f1ce7522bc9f27d0bc2a81c55264, < 8510c2346d9e47a72b7f018a36ef0c39483e53d6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mm/mempolicy package is a component of the Linux Kernel, which is responsible for managing memory policies in the system. It provides functionality to control the allocation and placement of memory for processes. The shared_policy_replace function in this package is vulnerable to a memory leak issue, which can potentially lead to resource exhaustion and system instability.
Vulnerability Detail
The vulnerability arises from a memory leak in the shared_policy_replace function of the mm/mempolicy package. When replacing a shared memory policy, the function fails to free the previously allocated memory, resulting in a continuous accumulation of memory over time. An attacker could exploit this vulnerability by repeatedly triggering the shared_policy_replace function, causing a denial-of-service condition or system instability due to resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the shared_policy_replace function excessively. Limiting the frequency of calls to this function can help mitigate the memory leak issue. However, this is not a permanent solution and updating the kernel is still recommended.
Conclusion
The mm/mempolicy package in the Linux Kernel is vulnerable to a memory leak issue in the shared_policy_replace function. This vulnerability can lead to resource exhaustion and system instability. It is recommended to update the kernel to version v4.9.311 or later to fix the issue. Limiting the frequency of calls to the shared_policy_replace function can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, potentially causing resource exhaustion and system instability.
An attacker can exploit this vulnerability by repeatedly triggering the shared_policy_replace function, causing a denial-of-service condition or system instability.
The vulnerability was introduced in version v3.8 of the Linux Kernel and is present in all versions prior to v4.9.311.
Yes, the vulnerability has been fixed in Linux Kernel version v4.9.311. Updating the kernel to this version or later will resolve the issue.
A temporary workaround is to limit the frequency of calls to the shared_policy_replace function. However, updating the kernel is still recommended for a permanent solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
