Vulnerability in Kernel package: rtc: mt6397
Summary
GSD-2022-1002628: rtc: mt6397: check return value after calling platform_get_resource(). Affects Kernel versions >= fc2979118f3f5193475cb53d5df7bdaa7e358a42, < da38e86d6cf6dd3bc65c602d998f357145aa1a0b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services and interfaces for hardware devices, including the Real-Time Clock (RTC). The RTC is responsible for keeping track of time even when the system is powered off. The mt6397 driver within the Kernel package specifically handles the RTC functionality for devices using the MediaTek MT6397 chipset. This vulnerability affects the mt6397 driver and its interaction with the platform_get_resource() function.
Vulnerability Detail
The vulnerability in the mt6397 driver arises from a failure to check the return value after calling the platform_get_resource() function. This oversight can lead to potential security vulnerabilities, although the exact impact and attack plausibility have not been proven. The vulnerability was introduced in version v4.2 of the Linux Kernel by commit fc2979118f3f5193475cb53d5df7bdaa7e358a42 and has been fixed in version v5.18.4 by commit da38e86d6cf6dd3bc65c602d998f357145aa1a0b. It is crucial to update to the fixed version to mitigate the vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Kernel package's mt6397 driver highlights the importance of regularly updating software components to address security vulnerabilities. By updating to version v5.18.4 or later, users can ensure the mitigation of this vulnerability. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is not yet proven. However, it has the potential to introduce security vulnerabilities, which could be exploited by attackers to gain unauthorized access or disrupt system functionality.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
No specific workaround has been provided for this vulnerability. It is recommended to update the Kernel package to the fixed version as soon as possible.
The remote exploitability of this vulnerability is not yet determined. However, it is advisable to apply the fix to prevent any potential remote exploitation.
There are no known instances of this vulnerability being exploited at the moment. However, it is crucial to update to the fixed version to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
