Vulnerability in Kernel package: Input: sparcspkr - fix refcount leak in bbc_beep_probe
Summary
GSD-2022-1002706: Input: sparcspkr - fix refcount leak in bbc_beep_probe. Affects Kernel versions >= 9c1a5077fdca99356c891af37931e537dea874f5, < 1124e39fea0e2fdb4202f95b716cb97cc7de7cc7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and interfaces for various hardware and software components. The sparcspkr module within the Kernel package is responsible for handling the system speaker on SPARC-based systems. It allows generating beeping sounds for various system events. However, a vulnerability has been discovered in the bbc_beep_probe function of the sparcspkr module, leading to a refcount leak. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service condition or execute arbitrary code.
Vulnerability Detail
The vulnerability originates from a refcount leak in the bbc_beep_probe function of the sparcspkr module. When the function is called multiple times, it fails to properly release the reference count, resulting in a resource leak. An attacker could potentially trigger this vulnerability by repeatedly invoking the bbc_beep_probe function, causing a gradual depletion of system resources. This could lead to a denial-of-service condition where the system becomes unresponsive or crashes. Additionally, if an attacker can control the input to the bbc_beep_probe function, they may be able to exploit this vulnerability to execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel package is not immediately feasible, a temporary workaround can be implemented by disabling the sparcspkr module. This can be achieved by executing the following command as root:
rmmod sparcspkr
Conclusion
In conclusion, the Kernel package is affected by a vulnerability in the sparcspkr module's bbc_beep_probe function, which can result in a denial-of-service condition or arbitrary code execution. Users are advised to update their Kernel package to version v5.18.3 or later to mitigate this vulnerability. If immediate updating is not possible, disabling the sparcspkr module can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service condition or enable an attacker to execute arbitrary code with elevated privileges.
The vulnerability was introduced in version v2.6.26 of the Linux Kernel package and persists until version v5.18.2.
At the time of this report, there are no known public exploits targeting this specific vulnerability.
The recommended mitigation is to update the Kernel package to the latest version, which includes the fix for this vulnerability.
This vulnerability requires local access to the system in order to trigger the bbc_beep_probe function and exploit the refcount leak.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
