Fix deadlock in rtw_surveydone_event_callback() in drivers: staging: rtl8723bs
Summary
GSD-2022-1002551: drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback(). Affects Kernel versions < 2c41f5c341853f84b7bc2f32605d4e2782e8c279. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rtl8723bs driver is a staging driver in the Linux Kernel that provides support for Realtek RTL8723BS wireless chipsets. This driver is used for managing wireless network connections on devices that utilize these chipsets. The rtw_surveydone_event_callback() function is responsible for handling survey done events, which provide information about the wireless environment. However, a deadlock issue has been identified in this function, which can lead to system instability and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability in rtw_surveydone_event_callback() arises due to a deadlock situation. When this function is called, it can acquire a lock and wait for a specific condition to be met. However, if the condition is not satisfied, the function can enter a deadlock state, where it remains indefinitely, causing the system to become unresponsive. This vulnerability can be exploited by an attacker to disrupt the wireless functionality of affected devices or potentially crash the system. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The deadlock issue in rtw_surveydone_event_callback() in the drivers: staging: rtl8723bs has been fixed in Linux Kernel version v5.18.4. Users are advised to update their Linux Kernel to this version or later to ensure their systems are protected against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from system instability to potential denial-of-service attacks. An attacker can exploit this vulnerability to disrupt wireless functionality or crash the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch has been released in Linux Kernel version v5.18.4. Users should update their kernel to this version or later to fix the vulnerability.
The exact attack vector and exploitability of this vulnerability have not been proven. However, in theory, an attacker could potentially exploit this vulnerability remotely if they can trigger the deadlock situation in the rtw_surveydone_event_callback() function.
There are no known instances of this vulnerability being exploited in the wild. However, it is always recommended to apply security patches and updates to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
