Refcount Leak in altera_tse_mdio_create in Kernel
Summary
GSD-2022-1002943: net: altera: Fix refcount leak in altera_tse_mdio_create. Affects Kernel versions >= bbd2190ce96d8fce031f0526c1f970b68adc9d1a, < 803b217f1fb49a2dbb2123acdb45111b9c48b8be. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The altera_tse_mdio_create function in the Kernel's net: altera module is responsible for creating a management data input/output (MDIO) interface for Altera Ethernet devices. This interface allows communication between the Ethernet device and the MDIO bus. However, a refcount leak vulnerability has been identified in the altera_tse_mdio_create function.
Vulnerability Detail
The refcount leak vulnerability in altera_tse_mdio_create can lead to a resource leak, potentially causing memory corruption or exhaustion. An attacker could exploit this vulnerability to trigger a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in version v3.15 of the Linux Kernel and was fixed in version v5.17.15. The vulnerability occurs due to improper handling of reference counts in the altera_tse_mdio_create function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the recommended fix by updating the Linux Kernel to the latest version.
Conclusion
The refcount leak vulnerability in altera_tse_mdio_create poses a risk of resource leak, memory corruption, and potential privilege escalation. It is crucial to update the Linux Kernel to version v5.17.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a resource leak, potentially causing memory corruption or exhaustion. It could be exploited by an attacker to trigger a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
No, there is no specific workaround available for this vulnerability. It is recommended to update the Linux Kernel to the latest version to fix the issue.
The vulnerability was introduced in version v3.15 of the Linux Kernel. All versions between v3.15 and v5.17.14 are affected. It is advised to update to version v5.17.15 or later to mitigate the vulnerability.
You can find more information about this vulnerability in the GSD-2022-1002943 entry of the GSD database. The entry is available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002943.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
