Double Free Vulnerability in rpmsg: virtio Package
Summary
GSD-2022-1002990: rpmsg: virtio: Fix possible double free in rpmsg_probe(). Affects Kernel versions >= c486682ae1e2b149add22f44cf413b3103e3ef39, < c49fb74e050d01ea09703b7c0d5fe8b9c3855b60. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rpmsg: virtio package is a component of the Linux Kernel ecosystem. It provides support for remote processor messaging (RPMsg) over virtio, which allows communication between different processors in a virtualized environment. RPMsg is commonly used in embedded systems and IoT devices. The package implements the rpmsg_probe() function, which is responsible for initializing RPMsg devices. However, a vulnerability has been discovered in this function that can lead to a double free condition.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1002990, originates from a possible double free issue in the rpmsg_probe() function of the rpmsg: virtio package. When this function is called, it may inadvertently free a resource twice, potentially leading to memory corruption or a crash. The impact and attack plausibility of this vulnerability have not been proven yet. It was introduced in version v5.13 of the Linux Kernel and has been fixed in version v5.17.15 by commit c49fb74e050d01ea09703b7c0d5fe8b9c3855b60.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from using the affected rpmsg: virtio package or disabling the functionality that triggers the rpmsg_probe() function. However, it is strongly advised to apply the official fix by updating to the patched version of the Linux Kernel.
Conclusion
In conclusion, the rpmsg: virtio package in the Linux Kernel is vulnerable to a double free issue in the rpmsg_probe() function. This vulnerability can potentially lead to memory corruption or crashes. It is recommended to update the Linux Kernel to version v5.17.15 or later to mitigate this vulnerability. Users can find further support and assistance regarding vulnerability remediation by contacting DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The rpmsg: virtio package is a component of the Linux Kernel that enables remote processor messaging (RPMsg) over virtio, facilitating communication between processors in a virtualized environment.
The impact of this vulnerability is not yet proven, but it could potentially lead to memory corruption or crashes in systems utilizing the affected rpmsg: virtio package.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.15 or later, which includes the necessary patch to address the issue.
Yes, users can avoid the vulnerability by not using the affected rpmsg: virtio package or disabling the functionality that triggers the rpmsg_probe() function. However, it is advisable to apply the official fix by updating to the patched version of the Linux Kernel.
For more information about this vulnerability, you can refer to the official vulnerability database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002990.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
