gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade perf | Jul 4, 2022 | May 5, 2020 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 5, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-perfUpgrade kernel-develUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-sourceUpgrade perfUpgrade python-perf | May 27, 2020 | May 5, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 5, 2020 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-docs | Jun 10, 2020 | May 5, 2020 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-5.4.0-45-generic-lpaeUpgrade linux-image-5.4.0-1022-awsUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.15.0-1084-snapdragonUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-45-lowlatencyUpgrade linux-image-5.4.0-45-genericUpgrade linux-image-oracleUpgrade linux-image-4.15.0-1051-oracleUpgrade linux-image-genericUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1093-azureUpgrade linux-image-aws-edgeUpgrade linux-image-raspi2Upgrade linux-image-oem-osp1Upgrade linux-image-gkeUpgrade linux-image-4.15.0-115-lowlatencyUpgrade linux-image-azure-edgeUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-1081-gcpUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1016-raspiUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1023-azureUpgrade linux-image-azure-lts-18.04Upgrade linux-image-gke-5.4Upgrade linux-image-5.4.0-1022-oracleUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-snapdragonUpgrade linux-image-aws-lts-18.04Upgrade linux-image-4.15.0-1068-raspi2Upgrade linux-image-azureUpgrade linux-image-awsUpgrade linux-image-4.15.0-1072-kvmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-raspiUpgrade linux-image-oemUpgrade linux-image-4.15.0-1080-awsUpgrade linux-image-4.15.0-1094-oemUpgrade linux-image-4.15.0-115-genericUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-aws-hweUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1022-gcpUpgrade linux-image-4.15.0-1067-gkeUpgrade linux-image-gkeop-5.4Upgrade linux-image-4.15.0-115-generic-lpaeUpgrade linux-image-gke-4.15 | Sep 2, 2020 | May 5, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 5, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub