Vulnerability in Kernel package: bus: mhi: pci_generic
Summary
GSD-2021-1000087: bus: mhi: pci_generic: Remove WQ_MEM_RECLAIM flag from state workqueue. Affects Kernel versions >= 8f70397876872789b2a5deba804eb6216fb5deb7, < ed541cff35cbdb695f0c98ef506dd7218883fc07. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The bus: mhi: pci_generic module within the Kernel package is specifically designed for handling MHI (Mobile High-Definition Link) devices connected via PCI (Peripheral Component Interconnect) bus. These devices include modems, wireless adapters, and other peripherals. However, a vulnerability has been identified in the bus: mhi: pci_generic module, which could potentially be exploited by attackers to gain unauthorized access or execute arbitrary code on the system.
Vulnerability Detail
The vulnerability in the bus: mhi: pci_generic module arises from the improper usage of the WQ_MEM_RECLAIM flag in the state workqueue. This flag, when enabled, allows the workqueue to reclaim memory when it becomes scarce. However, in this case, the flag is unnecessary and can lead to memory leaks or other memory-related issues. An attacker could potentially exploit this vulnerability by triggering a series of events that exhaust system memory, leading to a denial-of-service condition or even arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected module, bus: mhi: pci_generic, if it is not essential for their system's functionality. Disabling the module will prevent the vulnerability from being exploited. However, this workaround may result in the loss of functionality provided by MHI devices connected via PCI bus.
Conclusion
The vulnerability in the bus: mhi: pci_generic module of the Kernel package poses potential security risks, including unauthorized access and arbitrary code execution. It is crucial to update the Kernel package to the latest version, v5.12.3 or later, to mitigate this vulnerability. Users can also consider disabling the affected module as a temporary workaround, but this may impact the functionality of MHI devices connected via PCI bus. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a core component of the Linux operating system, responsible for managing the system's core functionality and providing an interface between hardware and software layers.
The bus: mhi: pci_generic module is a part of the Kernel package and is specifically designed for handling MHI devices connected via PCI bus. These devices include modems, wireless adapters, and other peripherals.
The impact of this vulnerability is not yet proven. However, it could potentially allow attackers to gain unauthorized access or execute arbitrary code on the system, leading to various security risks.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v5.12.3 or later, which addresses the issue by removing the WQ_MEM_RECLAIM flag from the state workqueue.
Yes, users can disable the affected module, bus: mhi: pci_generic, if it is not essential for their system's functionality. However, this may result in the loss of functionality provided by MHI devices connected via PCI bus.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
