Refcount Leaks in am65-cpsw-nuss Ethernet Driver in Linux Kernel
Summary
GSD-2022-1002972: net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks. Affects Kernel versions >= b1f66a5bee07adaab218fb98800928185e5f0f18, < 78aca10a16f001c9f49f1cc4dadfee8d444bb173. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The am65-cpsw-nuss Ethernet driver is a component of the Linux Kernel that provides support for the AM65x CPSW NUSS (Network Subsystem Switch) Ethernet controller. This controller is commonly found in Texas Instruments' AM65x SoCs (System on Chips). The driver enables the functionality of the Ethernet controller, allowing communication over Ethernet networks. However, a vulnerability has been identified in the driver that leads to refcount leaks.
Vulnerability Detail
The vulnerability in the am65-cpsw-nuss Ethernet driver results in refcount leaks. Refcounting is a mechanism used in the Linux Kernel to manage the lifetime of objects. When an object is referenced, its reference count is incremented, and when it is no longer needed, the count is decremented. If the count reaches zero, the object is freed. In the case of the am65-cpsw-nuss driver, there are instances where the reference count is not properly decremented, leading to memory leaks. These leaks can potentially exhaust system resources and cause instability or denial-of-service conditions. The vulnerability was introduced in version v5.8 of the Linux Kernel and has been fixed in version v5.17.15.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel as mentioned in the 'how_to_fix' section.
Conclusion
The refcount leaks in the am65-cpsw-nuss Ethernet driver pose a risk of memory leaks and potential system instability or denial-of-service conditions. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.17.15 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The refcount leaks can lead to memory leaks, potentially causing system instability or denial-of-service conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any known vulnerabilities, including this one, are found.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix to prevent any potential exploitation in the future.
The vulnerability itself does not provide remote code execution capabilities. However, if an attacker can gain access to the affected system, they may be able to leverage the memory leaks caused by the refcount leaks to further exploit the system.
Unfortunately, there are no known mitigations for this vulnerability other than applying the fix by updating the Linux Kernel. It is recommended to prioritize the update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
