Kernel Vulnerability in Linux Package: Resolution for GFP_DMA32 Warning in cdns3 Driver
Summary
CVE-2022-50151: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix random warning message when driver load Warning log: [ 4.141392] Unexpected gfp: 0x4 (GFP_DMA32). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources and facilitates communication between hardware and applications. The cdns3 driver is responsible for handling USB controller functionalities, and its proper operation is critical for device connectivity. The vulnerability identified as CVE-2022-50151 relates to improper memory allocation flags, which can lead to unexpected behavior during driver loading.
Vulnerability Detail
CVE-2022-50151 is a vulnerability in the Linux kernel's cdns3 driver that arises from the use of inappropriate memory allocation flags (GFP_DMA32) during the allocation of DMA memory. This can trigger warning messages and potentially lead to unstable system behavior. The warning log indicates that the memory allocation flags used are not suitable for the operation being performed, which could result in performance degradation or system crashes if not addressed. The root cause lies in the improper handling of memory flags in the cdns3_allocate_trb_pool function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the latest version of the Linux package as mentioned in the 'how_to_fix' section.
Conclusion
The CVE-2022-50151 vulnerability in the Linux kernel's cdns3 driver highlights the importance of proper memory allocation practices. Users are encouraged to update their systems to the latest version to mitigate potential risks associated with this issue. Utilizing tools like Vulert can further enhance vulnerability management and ensure system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50151 is a vulnerability in the Linux kernel's cdns3 driver related to improper memory allocation flags, which can lead to warning messages and potential system instability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities using a manifest file like package-lock.json.
If left unaddressed, this vulnerability may lead to unexpected behavior during driver loading, including performance issues or system crashes.
Yes, a patch is available. Users should update their Linux package to version 6.0.2-1 or later to resolve the issue.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software without requiring code access. It uses a manifest file to track vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
