Kernel Vulnerability in Linux Package: Slab Out-of-Bounds Access in DA9121 Regulator
Summary
CVE-2022-49507: In the Linux kernel, the following vulnerability has been resolved: regulator: da9121: Fix uninit-value in da9121_assign_chip_model() KASAN report slab-out-of-bounds in regmap_init as follows: BUG: KASAN: slab-out-of-bou... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including device drivers, process management, and memory management. The DA9121 regulator is a power management device that regulates voltage levels for various components. This vulnerability arises from improper handling of device initialization, which can lead to memory access violations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DA9121 regulator driver, specifically in the function da9121_assign_chip_model(). When the DA9121 device is probed with an invalid device tree source (DTS), the subvariant_id is incorrectly set to -EINVAL. This leads to a slab-out-of-bounds access when the function attempts to access the 'regmap' without proper initialization. The KASAN (Kernel Address Sanitizer) report indicates a read of size 1 at an invalid memory address, which can potentially cause system instability or crashes.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package to the fixed version.
Conclusion
The CVE-2022-49507 vulnerability in the Linux kernel's DA9121 regulator poses significant risks due to improper memory access handling. Users are strongly encouraged to update their systems to the patched version to mitigate these risks. Regular monitoring and using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49507 is a vulnerability in the Linux kernel related to the DA9121 regulator, which can lead to slab-out-of-bounds memory access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include potential system crashes, instability, and unauthorized access to memory, which can compromise system security.
Yes, a patch is available in the form of an updated package version 5.18.5-1 for Debian 12 and 13.
If you cannot update your package, it is advisable to monitor your system closely for any unusual behavior and consider implementing additional security measures.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
