CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2124 vulnerabilities reference this CWE, most recent first.
GHSA-PVP3-22V7-6XCV
Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2025-09-25 18:30In the Linux kernel, the following vulnerability has been resolved:
efivarfs: Free s_fs_info on unmount
Now that we allocate a s_fs_info struct on fs context creation, we should ensure that we free it again when the superblock goes away.
{
"affected": [],
"aliases": [
"CVE-2023-52681"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T15:15:19Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: Free s_fs_info on unmount\n\nNow that we allocate a s_fs_info struct on fs context creation, we\nshould ensure that we free it again when the superblock goes away.",
"id": "GHSA-pvp3-22v7-6xcv",
"modified": "2025-09-25T18:30:28Z",
"published": "2024-05-17T15:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52681"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48be1364dd387e375e1274b76af986cb8747be2c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/547713d502f7b4b8efccd409cff84d731a23853b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/92be3095c6ca1cdc46237839c6087555be9160e3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ea6b597fcaca99562fa56a473bcbbbd79b40af03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PVXG-RPP4-G743
Vulnerability from github – Published: 2022-10-27 12:00 – Updated: 2022-10-28 19:00A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-3669"
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-26T19:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.",
"id": "GHSA-pvxg-rpp4-g743",
"modified": "2022-10-28T19:00:40Z",
"published": "2022-10-27T12:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3669"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/776"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/files/9675042/Bug_2_POC.zip"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.212009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW6X-273J-MP83
Vulnerability from github – Published: 2026-06-25 09:31 – Updated: 2026-07-08 18:31In the Linux kernel, the following vulnerability has been resolved:
wifi: fix leak if split 6 GHz scanning fails
rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's supposed to be released at ___cfg80211_scan_done() but this doesn't happen as rdev->scan_req is NULL at that point, too, leading to the early return from the freeing function.
unreferenced object 0xffff8881161d0800 (size 512): comm "wpa_supplicant", pid 379, jiffies 4294749765 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................ backtrace (crc c867fdb6): kmemleak_alloc+0x89/0x90 __kmalloc_noprof+0x2fd/0x410 cfg80211_scan+0x133/0x730 nl80211_trigger_scan+0xc69/0x1cc0 genl_family_rcv_msg_doit+0x204/0x2f0 genl_rcv_msg+0x431/0x6b0 netlink_rcv_skb+0x143/0x3f0 genl_rcv+0x27/0x40 netlink_unicast+0x4f6/0x820 netlink_sendmsg+0x797/0xce0 __sock_sendmsg+0xc4/0x160 _syssendmsg+0x5e4/0x890 _sys_sendmsg+0xf8/0x180 __sys_sendmsg+0x136/0x1e0 __x64_sys_sendmsg+0x76/0xc0 x64_sys_call+0x13f0/0x17d0
Found by Linux Verification Center (linuxtesting.org).
{
"affected": [],
"aliases": [
"CVE-2026-53258"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T09:16:43Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: fix leak if split 6 GHz scanning fails\n\nrdev-\u003eint_scan_req is leaked if cfg80211_scan() fails. Note that it\u0027s\nsupposed to be released at ___cfg80211_scan_done() but this doesn\u0027t happen\nas rdev-\u003escan_req is NULL at that point, too, leading to the early return\nfrom the freeing function.\n\nunreferenced object 0xffff8881161d0800 (size 512):\n comm \"wpa_supplicant\", pid 379, jiffies 4294749765\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................\n backtrace (crc c867fdb6):\n kmemleak_alloc+0x89/0x90\n __kmalloc_noprof+0x2fd/0x410\n cfg80211_scan+0x133/0x730\n nl80211_trigger_scan+0xc69/0x1cc0\n genl_family_rcv_msg_doit+0x204/0x2f0\n genl_rcv_msg+0x431/0x6b0\n netlink_rcv_skb+0x143/0x3f0\n genl_rcv+0x27/0x40\n netlink_unicast+0x4f6/0x820\n netlink_sendmsg+0x797/0xce0\n __sock_sendmsg+0xc4/0x160\n ____sys_sendmsg+0x5e4/0x890\n ___sys_sendmsg+0xf8/0x180\n __sys_sendmsg+0x136/0x1e0\n __x64_sys_sendmsg+0x76/0xc0\n x64_sys_call+0x13f0/0x17d0\n\nFound by Linux Verification Center (linuxtesting.org).",
"id": "GHSA-pw6x-273j-mp83",
"modified": "2026-07-08T18:31:32Z",
"published": "2026-06-25T09:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53258"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW7F-949H-594R
Vulnerability from github – Published: 2024-01-12 03:30 – Updated: 2024-01-12 03:30A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
If an MX Series device receives PTP packets on an MPC3E that doesn't support PTP this causes a memory leak which will result in unpredictable behavior and ultimately in an MPC crash and restart.
To monitor for this issue, please use the following FPC vty level commands:
show heap shows an increase in "LAN buffer" utilization and
show clksync ptp nbr-upd-info shows non-zero "Pending PFEs" counter.
This issue affects Juniper Networks Junos OS on MX Series with MPC3E:
- All versions earlier than 20.4R3-S3;
- 21.1 versions earlier than 21.1R3-S4;
- 21.2 versions earlier than 21.2R3;
- 21.3 versions earlier than 21.3R2-S1, 21.3R3;
- 21.4 versions earlier than 21.4R2;
- 22.1 versions earlier than 22.1R2.
{
"affected": [],
"aliases": [
"CVE-2024-21599"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T01:15:47Z",
"severity": "MODERATE"
},
"details": "\nA Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).\n\nIf an MX Series device receives PTP packets on an MPC3E that doesn\u0027t support PTP this causes a memory leak which will result in unpredictable behavior and ultimately in an MPC crash and restart.\n\nTo monitor for this issue, please use the following FPC vty level commands:\n\nshow heap\nshows an increase in \"LAN buffer\" utilization and\n\nshow clksync ptp nbr-upd-info\nshows non-zero \"Pending PFEs\" counter.\n\nThis issue affects Juniper Networks Junos OS on MX Series with MPC3E:\n\n\n\n * All versions earlier than 20.4R3-S3;\n * 21.1 versions earlier than 21.1R3-S4;\n * 21.2 versions earlier than 21.2R3;\n * 21.3 versions earlier than 21.3R2-S1, 21.3R3;\n * 21.4 versions earlier than 21.4R2;\n * 22.1 versions earlier than 22.1R2.\n\n\n\n\n\n\n",
"id": "GHSA-pw7f-949h-594r",
"modified": "2024-01-12T03:30:48Z",
"published": "2024-01-12T03:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21599"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA75740"
},
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW7F-JVGM-W775
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-04-28 18:30In the Linux kernel, the following vulnerability has been resolved:
HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
{
"affected": [],
"aliases": [
"CVE-2026-31522"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:52Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: avoid memory leak in magicmouse_report_fixup()\n\nThe magicmouse_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller.",
"id": "GHSA-pw7f-jvgm-w775",
"modified": "2026-04-28T18:30:29Z",
"published": "2026-04-22T15:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31522"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW82-JCJX-2282
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-13 21:31In the Linux kernel, the following vulnerability has been resolved:
memory: mtk-smi: fix device leaks on common probe
Make sure to drop the reference taken when looking up the SMI device during common probe on late probe failure (e.g. probe deferral) and on driver unbind.
{
"affected": [],
"aliases": [
"CVE-2025-71288"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:27Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: mtk-smi: fix device leaks on common probe\n\nMake sure to drop the reference taken when looking up the SMI device\nduring common probe on late probe failure (e.g. probe deferral) and on\ndriver unbind.",
"id": "GHSA-pw82-jcjx-2282",
"modified": "2026-05-13T21:31:56Z",
"published": "2026-05-06T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71288"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6cfa038bddd710f544076ea2ef7792fc82fbedd6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9704564a70399c2787f5a7c5d347add721056e9d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/984992f31cfb71b25cd0a72ef51ceb5dd6f187e8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b16599fedf49fd42d174fba342a0b56103df3169"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b44d090d6ca159d94b59ad4cc44ffdaca094df82"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b8b2cf42b94c0a8efe43279643935256a6f58b9f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW84-W4V5-39JJ
Vulnerability from github – Published: 2024-07-29 15:30 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix quota root leak after quota disable failure
If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps).
Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted.
{
"affected": [],
"aliases": [
"CVE-2024-41078"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T15:15:15Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix quota root leak after quota disable failure\n\nIf during the quota disable we fail when cleaning the quota tree or when\ndeleting the root from the root tree, we jump to the \u0027out\u0027 label without\never dropping the reference on the quota root, resulting in a leak of the\nroot since fs_info-\u003equota_root is no longer pointing to the root (we have\nset it to NULL just before those steps).\n\nFix this by always doing a btrfs_put_root() call under the \u0027out\u0027 label.\nThis is a problem that exists since qgroups were first added in 2012 by\ncommit bed92eae26cc (\"Btrfs: qgroup implementation and prototypes\"), but\nback then we missed a kfree on the quota root and free_extent_buffer()\ncalls on its root and commit root nodes, since back then roots were not\nyet reference counted.",
"id": "GHSA-pw84-w4v5-39jj",
"modified": "2025-11-04T00:31:03Z",
"published": "2024-07-29T15:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41078"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5ef3961682e5310f2221bae99bcf9f5d0f4b0d51"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7dd6a5b96157a21245566b21fd58276a214357ff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a69529f22590b67bb018de9acbcf94abc8603cf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/94818bdb00ef34a996a06aa63d11f591074cb757"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a7e4c6a3031c74078dba7fa36239d0f4fe476c53"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f88aeff5a173e8ba3133314eb4b964236ef3589d"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PWF7-JC5H-RR33
Vulnerability from github – Published: 2024-06-20 12:31 – Updated: 2024-09-09 15:30In the Linux kernel, the following vulnerability has been resolved:
tracing/histogram: Fix a potential memory leak for kstrdup()
kfree() is missing on an error path to free the memory allocated by kstrdup():
p = param = kstrdup(data->params[i], GFP_KERNEL);
So it is better to free it via kfree(p).
{
"affected": [],
"aliases": [
"CVE-2022-48768"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T12:15:14Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histogram: Fix a potential memory leak for kstrdup()\n\nkfree() is missing on an error path to free the memory allocated by\nkstrdup():\n\n p = param = kstrdup(data-\u003eparams[i], GFP_KERNEL);\n\nSo it is better to free it via kfree(p).",
"id": "GHSA-pwf7-jc5h-rr33",
"modified": "2024-09-09T15:30:37Z",
"published": "2024-06-20T12:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48768"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a8878ebb596281f50fc0b9a6e1f23f0d7f154e8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d71b06aa995007eafd247626d0669b9364c42ad7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/df86e2fe808c3536a9dba353cc2bebdfea00d0cf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e33fa4a46ee22de88a700e2e3d033da8214a5175"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e629e7b525a179e29d53463d992bdee759c950fb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PWQ9-W59R-4V6M
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2022-06-17 00:01Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
{
"affected": [],
"aliases": [
"CVE-2019-12265"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-09T19:15:00Z",
"severity": "MODERATE"
},
"details": "Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.",
"id": "GHSA-pwq9-w59r-4v6m",
"modified": "2022-06-17T00:01:23Z",
"published": "2022-05-24T16:53:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12265"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190802-0001"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K41190253"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12265"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=security-notices"
},
{
"type": "WEB",
"url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PWQM-5JRG-2V3G
Vulnerability from github – Published: 2024-05-21 15:31 – Updated: 2024-12-24 18:30In the Linux kernel, the following vulnerability has been resolved:
nfs: fix acl memory leak of posix_acl_create()
When looking into another nfs xfstests report, I found acl and default_acl in nfs3_proc_create() and nfs3_proc_mknod() error paths are possibly leaked. Fix them in advance.
{
"affected": [],
"aliases": [
"CVE-2021-47320"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:19Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix acl memory leak of posix_acl_create()\n\nWhen looking into another nfs xfstests report, I found acl and\ndefault_acl in nfs3_proc_create() and nfs3_proc_mknod() error\npaths are possibly leaked. Fix them in advance.",
"id": "GHSA-pwqm-5jrg-2v3g",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47320"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0704f617040c397ae73c1f88f3956787ec5d6529"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1fcb6fcd74a222d9ead54d405842fc763bb86262"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2e3960f276b4574a9bb0dfa31a7497302f6363b2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4b515308ab875c7e8ada8e606fe0c64762da5ed4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/687cf32865b2d6960214bce523f2afac58dd3cd2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a2b308a54c5ec224fedc753617f99b29ffcd883"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c8fc86e9df6a6a03f5a8e15a3b7a5c75fd05aa38"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cef9d9acb7c80ed6bace894b6334557fd493863b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d0b32dc1409f7e65e4fcc34e236462268e69a357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.