Critical Vulnerability in Linux Package: Sleeping in Atomic Context
Summary
CVE-2022-50371: In the Linux kernel, the following vulnerability has been resolved: led: qcom-lpg: Fix sleeping in atomic lpg_brighness_set() function can sleep, while led's brightness_set() callback must be non-blocking. Affects linux versions < 6.1.4-1. Fixed in 6.1.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and performance. This vulnerability specifically affects the LED driver in the Linux kernel, which is responsible for controlling LED brightness. The issue arises from the 'lpg_brightness_set()' function, which can sleep in an atomic context, leading to potential system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the LED driver related to the Qualcomm Low Power GPIO (lpg) functionality. The 'lpg_brightness_set()' function is designed to adjust LED brightness but is incorrectly implemented to allow sleeping in an atomic context, which is not permitted. This can lead to system crashes or unexpected behavior, as the kernel expects non-blocking operations in this context. The vulnerability is documented under CVE-2022-50371 and affects multiple Debian versions, including Debian 12, 13, and 14.
How To Fix
Minimum fixed version
6.1.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating to the fixed version of the Linux package.
Conclusion
The vulnerability CVE-2022-50371 in the Linux kernel poses a significant risk due to its potential to cause system instability. It is essential for users to update to the patched version of the Linux package to mitigate this risk. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50371 is a vulnerability in the Linux kernel related to the LED driver, which can cause system instability due to improper handling of atomic context.
You can use the Vulert platform to check if your application is affected by this vulnerability. Visit Vulert Scanner to analyze your manifest file.
If exploited, this vulnerability can lead to system crashes, unexpected behavior, and potential data loss due to improper handling of LED brightness adjustments.
Yes, a patch is available. Users should update to version 6.1.4-1 or later of the Linux package to mitigate this vulnerability.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible to ensure system stability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
