CVE-2021-46956

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtiofs: fix memory leak in virtio_fs_probe()

When accidentally passing twice the same tag to qemu, kmemleak ended up

reporting a memory leak in virtiofs. Also, looking at the log I saw the

following error (that's when I realised the duplicated tag):

virtiofs: probe of virtio5 failed with error -17

Here's the kmemleak log for reference:

unreferenced object 0xffff888103d47800 (size 1024):

comm "systemd-udevd", pid 118, jiffies 4294893780 (age 18.340s)

hex dump (first 32 bytes):

00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........

ff ff ff ff ff ff ff ff 80 90 02 a0 ff ff ff ff ................

backtrace:

[<000000000ebb87c1>] virtio_fs_probe+0x171/0x7ae [virtiofs]

[<00000000f8aca419>] virtio_dev_probe+0x15f/0x210

[<000000004d6baf3c>] really_probe+0xea/0x430

[<00000000a6ceeac8>] device_driver_attach+0xa8/0xb0

[<00000000196f47a7>] __driver_attach+0x98/0x140

[<000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References