DailyTech - Update: New Centrino Drivers Cause Massive Memory Leaks

Submit News

Gadgets Update: New Centrino Drivers Cause Massive Memory Leaks
Anh Tuan Huynh (Blog) - August 23, 2006 3:23 PM

E-mail

del.icio.us

39 comment(s) - last by MercenaryForHi.. on Aug 24 at 10:47 PM

New Intel PROSet drivers has memory consumption issues

DailyTech previously reported Intel’s Centrino wireless drivers have security flaws. Intel recently released updated drivers for the 2200BG, 2915ABG and 3945ABG series wireless adapters that address the security flaw. While the drivers address the security flaw it presents a new problem. This time around the new generic Intel PROSet 10.5 control panel with driver release 10.5.1.57 has a memory leak problem.

According to DailyTech reader "MercenaryForHire," the Intel S24EvMon wireless management service is having troubles releasing registry handles. This leads to massive memory consumption during regular operation. The steps to recreate the memory leak is quite simple and involves installing the generic Intel PROSet 10.5 control panel and 10.5.1.57 drivers, then monitoring open handles and monitor memory usage of the Intel S24EvMon service.

Our very own Brandon Hill was able to recreate the problem with the latest Intel PROSet driver and an Asus W5F notebook. Intel is well aware of the issue and places the blame on individual manufacturers, claiming individual OEMs modify the wireless cards for its own configuration and need to release specific driver updates. There’s no word on when or if Intel will address this issue, though DailyTech suggests using drivers from the notebook manufacturer.

Update 8/23/2006: Dell and HP branded driver releases 10.5.1.57 for the 3945ABG or 9.0.4.17 for the 2200BG/2915ABG are also affected.

Comments

Threshold

Username
Password
remember me

This article is over a month old, voting and posting comments is disabled

scvhost.exe

By ksherman on 8/23/2006 8:26:25 AM , Rating: 2

Why are there so many of them (scvhost.exe)running? I have that same problem... or rather, maybe not a proble, but it sure looks like it

RE: scvhost.exe

By Araemo on 8/23/2006 8:52:45 AM , Rating: 2

svchost is a generic system service process that can load many different dlls to perform different functions. For each function, it loads another instance of svchost.

The problem is if one of them starts misbehaving and takes up a ton of CPU or memory.. how the hell do you find out which one it is? :P (Process Explorer from SysInternals can help, but not all of the svchost instances report their service name.)

In short, it's probably not a problem. (Though smart viruses and such might name themselves svchost.exe since you're used to seeing a lot of copies of it)

Parent

RE: scvhost.exe

By Schadenfroh on 8/23/2006 10:08:58 AM , Rating: 5

Worried about SVCHost.exe? Go to the command prompt and type TASKLIST /SVC and find out what each of them are for.

Parent

RE: scvhost.exe

By Souka on 8/23/2006 10:25:58 AM , Rating: 3

very nice tip....a new one for my book.

:)

Parent

RE: scvhost.exe

By anonymo on 8/23/2006 1:18:49 PM , Rating: 2

yes, very helpful, thanks again!

Parent

RE: scvhost.exe

By GhandiInstinct on 8/23/06, Rating: 0

RE: scvhost.exe

By MercenaryForHire on 8/23/2006 6:07:05 PM , Rating: 2

Open a command prompt first (start | run | cmd) then type it in there.

Parent

RE: scvhost.exe

By CrystalBay on 8/23/2006 7:28:34 PM , Rating: 2

Schaden for Elite...

Parent

RE: scvhost.exe

By Mojo the Monkey on 8/24/2006 1:51:39 AM , Rating: 2

wow... who would have known that the ipodservice.exe is actually ipodsevice!

thank you thank you!

=P ;)

Parent

Memory "Leak"?

By Kensei on 8/23/2006 12:07:34 PM , Rating: 1

I've always wondered why anytime when consumed memory isn't being released correctly, it's called a memory leak. Just seems like the wrong metaphor to me. Nothing is being lost or actually leaking. It's just being "bogarted" by some errant software.

Things that make you say hmmmm....

Kensei

RE: Memory "Leak"?

By mgambrell on 8/23/2006 12:36:58 PM , Rating: 2

Can you think of a better metaphor for something that becomes unavailable in a slow trickle until eventually it is completely exhausted and something that needs only a little bit isnt able to get any? This is a leak, whether its the International Space Station leaking air, or your system leaking memory.

Parent

RE: Memory "Leak"?

By bldckstark on 8/23/2006 1:04:26 PM , Rating: 2

I was just getting ready to agree that it should not be called a leak, because the memory is retreivable, unlike a leak from my bladder. Then I saw the definition: To permit the escape, entry, or passage of something through a breach or flaw . Passage of memory allocation through a flaw pretty much sums it up.

Parent

RE: Memory "Leak"?

By MonkeyPaw on 8/23/2006 3:59:54 PM , Rating: 2

I think the term "memory leak" became popular with the Win9x shell, where "leaked" memory typically couldn't be recovered unless you rebooted. I think there were a few programs that would attempt to recover lost memory without the reboot, but MS never officially patched the hole--unless you call Win2k a patch. ;)

Parent

RE: Memory "Leak"?

By johnsonx on 8/23/2006 8:43:53 PM , Rating: 2

The term Memory Leak goes back long before Windows 98, or Windows Anything for that matter. "Memory Leaks" have been a problem since the earliest computer operating systems.
It's just a much bigger problem now due to the complex way memory is allocated among processes, and the myriad of resources that can be requested which also ultimately use memory.

Parent

RE: Memory "Leak"?

By johnsonx on 8/23/2006 8:48:52 PM , Rating: 2

lol...

"and I must say I was impressed to see that she made proper use of the word 'myriad' in her suicide note."

Parent

RE: Memory "Leak"?

By Kensei on 8/24/2006 1:29:37 PM , Rating: 2

I think your initial instinct was correct. What exactly escaped through the breach or flaw? The memory is still sitting there, it hasn't gone anywhere, it's just "busy" and not available for reuse. If you are busy and cannot perform any more tasks, do you say to another person "My ability to do more stuff has leaked out so you'll have to wait." I hope not.

Kensei

Parent

RE: Memory "Leak"?

By OtakuMax on 8/23/2006 7:15:26 PM , Rating: 2

er... "Memory Leak" is pretty much a standard term nowadays. As most people know what it means, is there a need to change it?
Besides, in the days before there is virtual memory and superuser mode, the allocated memory cannot be retrieved without rebooting. ie. it does appears that the system is leaking memory.

Parent

RE: Memory "Leak"?

By Kensei on 8/24/2006 1:34:07 PM , Rating: 2

I don't think I or anyone else would argure that it's become a standard term. The issue under debate is whether or not "memory leak" is a good way to describe memory that is not being released for reuse, no matter how long the term has been used in the industry.

Kensei

Parent

RE: Memory "Leak"?

By Kensei on 8/24/2006 12:51:06 PM , Rating: 2

At the moment I cannot think of a better metaphor. But since when is a bad metaphor better than no metaphor at all? Also, your space station analogy doesn't even parallel with how memory is used in computer systems. Computer memory is used temporarilly and then returned. The air in the space station is not "used temporarilly" by anything. When it's gone there is no expectation that it will be returned.

A much better analogy would be a public library. Books are loaned out but expected to be returned. If books are never returned, then eventually the library has no books to loan. The books didn't "leak" out of the library into the atmosphere, they were simply never returned. And what do librarians call these books.... unreturned books, not "leaked books." So maybe we could call it unreturned memory... not as spiffy as memory leakage, but at least it describes the phenomenon accurately.

Kensei

Parent

Morning update

By MercenaryForHire on 8/23/2006 10:16:58 AM , Rating: 3

I think I have a new record. After finding a machine that was patched Friday and not shut down - 2.6 million handles, all 1GB of physical RAM gone, and another 750MB of pagefile. Just for this one process.

I doubt that it is the vendor's fault on this, despite the official finger-pointing I got from Intel. The cause of the leak is unclosed registry handles. If you track them, you can watch as S24EvMon stupidly opens the same two handles over and over, but never closes them.

RE: Morning update

By MercenaryForHire on 8/23/2006 11:01:13 AM , Rating: 2

Confirmed - HP and Dell vendor-specific drivers are also affected by this. If your laptop vendor just repackaged the Intel supplied drivers (10.5.1.57 or 9.0.4.17) there's a good chance they're also hole-y.

Parent

RE: Morning update

By Vidmar on 8/23/2006 3:22:36 PM , Rating: 2

quote:
Intel is well aware of the issue and places the blame on individual manufacturers, claiming individual OEMs modify the wireless cards for its own configuration and need to release specific driver updates

Intel is not telling the truth about this as I have an actual Intel 2915ABG that I installed in a Winstron notebook. This is not an OEM card and it too has the very same problem.

Parent

Drip, drip, drip....

By sintaxera on 8/23/2006 6:13:02 AM , Rating: 2

So, the worst combination would be a wireless Centrino Tablet PC running an older version of Firefox. I'll remember that for someone I don't like.

RE: Drip, drip, drip....

By Bladen on 8/23/2006 6:23:51 AM , Rating: 2

WIth the unpatched USB 2 thing.

Parent

RE: Drip, drip, drip....

By marvdmartian on 8/23/2006 10:43:44 AM , Rating: 2

Better keep some paper towels handy!!!

Parent

Not surprised

By Suomynona on 8/23/2006 2:36:12 PM , Rating: 5

I'm not surprised considering the download was a whopping 90MB or something. That just screams bloated.

RE: Not surprised

By brownba on 8/23/2006 10:39:17 PM , Rating: 1

huh?
the size of an executable has zero correlation to whether or not it has memory leaks.

Parent

Stupid stupid bloatware drivers....

By sxr7171 on 8/24/2006 10:16:23 AM , Rating: 2

Why does a stupid piddly network card really need something to monitor it and run all the time? Why can't these companies design drivers that don't need to run a service for every little thing?

Is it really necessary to have a program start up on boot just to see what your network card is up to? This is why sometimes it pays to stick with the drivers that came with windows. That is unless you're one of 2 people in 500,000 who really need whatever this "Pro-Set" has to offer.

RE: Stupid stupid bloatware drivers....

By sxr7171 on 8/24/2006 10:19:05 AM , Rating: 2

Oops, sorry for a while I thought these drivers were for their gigabit ethernet, since those are also called Pro-Set. Still, if they didn't have 20 processes to watch over every little thing these sorts of issues are much less likely.

Parent

RE: Stupid stupid bloatware drivers....

By Phynaz on 8/24/2006 11:53:13 AM , Rating: 1

quote:
whatever this "Pro-Set" has to offer.

It appears you're bitching about the software, and at same time saying you don't know what it's used for.

Parent

Proset or the driver itself?

By Kornfeld on 8/23/2006 12:08:24 PM , Rating: 2

I can't tell by this if it would affect installations that merely load the device driver and none of the related utilites (ProSet). This is pretty common for corporate installations.

RE: Proset or the driver itself?

By MercenaryForHire on 8/23/2006 1:37:20 PM , Rating: 2

The event monitor is part of the PROSet utilities, so no - if you install JUST the ~6MB driver that's available and use WZC, you're safe from this. That's great for home users, but there's several flaws in using that setup for corporate:

1) Anyone pre-XP is SOL, since 2000 doesn't have WZC
2) If you use (L)EAP for 802.1x, you're also SOL
3) WZC provides no way to lock down certain behaviours - for example, PROSet lets you disallow ad-hoc networks, enforce a minimum security requirement for connecting to an access point, create common profiles for all users, etc

But good catch. That's definitely a workaround for the typical XP user - uninstall PROSet, leave the drivers, and use WZC.

Parent

Using drivers from the notebook manufacturer

By Webgod on 8/23/2006 11:08:31 PM , Rating: 2

My notebook manufacturer Acer only has the drivers that came with my notebook on its website. I bought it 10 months ago. This is the second time I've loaded regular Intel wi-fi drivers downloaded from Intel.com due to a reported Centrino security hole. I guess people have to expect to be able to use Intel's uncustomized drivers. This lack of manufacturer support (Acer) wouldn't really go in the corporate world.

RE: Using drivers from the notebook manufacturer

By fbrdphreak on 8/24/2006 9:15:00 AM , Rating: 2

quote:
This lack of manufacturer support (Acer) wouldn't really go in the corporate world.

That's why you don't see Acer's being used in the corporate world.

Parent

And....

By SnoMunke on 8/23/2006 7:17:17 AM , Rating: 2

...an exploding battery...

I am not having problems

By Shining Arcanine on 8/23/2006 8:14:24 PM , Rating: 2

I installed these drivers and I am not having problems. Then again, I disabled all of the bloat in favor of Windows' Wireless Zero Configuration tool. I had to do that because Intel's software did not properly support the AES encryption that is on my home network. I am glad to hear that doing that also solved another headache.

How do you...

By sandorski on 8/23/2006 8:48:43 PM , Rating: 2

...get a memory stain out of a new pair of pants?

I'm desperate!! :( :(

A fix for the home users who already have it installed

By MercenaryForHire on 8/24/2006 10:47:56 PM , Rating: 2

1) Uninstall the existing drivers and software from Add/Remove Programs
2) Download and install the previous version drivers from
http://downloadcenter.intel.com/scripts-df-externa...
3) Download and manually update your NIC drivers from
http://downloadcenter.intel.com/scripts-df-externa...

Corporate users who need a single automated package are in a bit more of a sticky situation. There's a lot more steps to that - if you need to know, shoot me an email.