Refcount Leak in scmi_regulator_probe in Kernel
Summary
GSD-2022-1002747: regulator: scmi: Fix refcount leak in scmi_regulator_probe. Affects Kernel versions >= 0fbeae70ee7ce98e18a47337cd1f205dd88589e9, < 4a59c763ef9b68c711dc2fd2ef4a6648da5480ee. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The scmi_regulator_probe is a module within the Kernel that handles the initialization and management of regulators in the System Control and Management Interface (SCMI) framework. Regulators are responsible for controlling voltage levels and power consumption in various hardware components. This vulnerability in the scmi_regulator_probe module can lead to a refcount leak, potentially causing resource exhaustion and system instability.
Vulnerability Detail
The vulnerability arises from a refcount leak in the scmi_regulator_probe module of the Kernel. When the module is probed, it fails to properly release the reference count on certain resources, leading to a leak. An attacker could exploit this vulnerability by repeatedly triggering the probe operation, causing the refcount to increment and eventually exhausting system resources. This could result in denial of service (DoS) conditions or other unpredictable behavior. The vulnerability was introduced in Kernel version v5.11 and has been fixed in version v5.18.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the scmi_regulator_probe module if it is not essential for their system's functionality. This can be achieved by modifying the Kernel configuration and excluding the module from the build. However, this workaround should only be considered if the module is not required, as it may impact the functionality of certain hardware components.
Conclusion
The refcount leak vulnerability in the scmi_regulator_probe module of the Kernel can lead to resource exhaustion and system instability. It is crucial to update the Kernel to version v5.18.3 or later to mitigate this vulnerability. Alternatively, users can disable the module if it is not necessary for their system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and system instability, potentially resulting in denial of service (DoS) conditions or other unpredictable behavior.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix or workaround to mitigate any potential risks.
This vulnerability requires local access to the system in order to trigger the probe operation and exploit the refcount leak. Therefore, it cannot be remotely exploited over a network.
The primary solution is to update the Kernel to the fixed version. However, if updating is not feasible, disabling the scmi_regulator_probe module can serve as a temporary workaround. It is important to note that this workaround should only be considered if the module is not essential for the system's functionality.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
