Vulnerability in phy: qcom-qmp package: fix reset-controller leak on probe errors
Summary
GSD-2022-1003001: phy: qcom-qmp: fix reset-controller leak on probe errors. Affects Kernel versions >= e78f3d15e115e8e764d4b1562b4fa538f2e22f6b, < feb05b10b3ed3ae21b851520a0d0b71685439517. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The phy: qcom-qmp package is a component of the Linux Kernel ecosystem. It provides support for Qualcomm QMP (Qualcomm Message Passing) PHYs, which are used for communication between different subsystems in Qualcomm SoCs. The package is responsible for managing the reset-controller functionality, which ensures proper initialization and reset of the PHYs. However, a vulnerability has been discovered in the package that can lead to a resource leak in certain error scenarios during the probe process.
Vulnerability Detail
The vulnerability in the phy: qcom-qmp package occurs when an error is encountered during the probe process. In such cases, the reset-controller resources are not properly released, leading to a resource leak. This can result in degraded system performance, instability, or even denial-of-service conditions. The vulnerability was introduced in version v4.12 of the Linux Kernel and has been fixed in version v5.17.14. The fix ensures that the reset-controller resources are correctly released in all probe error scenarios.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have proper system monitoring and alerting mechanisms in place to detect any abnormal behavior or resource exhaustion that may result from the resource leak.
Conclusion
The vulnerability in the phy: qcom-qmp package can lead to resource leaks and potential system instability. It is recommended to update the Linux Kernel to version v5.17.14 or later to fix this vulnerability. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource leaks, which may cause degraded system performance, instability, or denial-of-service conditions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Yes, a patch has been released in version v5.17.14 of the Linux Kernel. It is recommended to update to this version or later to fix the vulnerability.
While there is no specific workaround mentioned, having proper system monitoring and alerting mechanisms in place can help detect any abnormal behavior or resource exhaustion resulting from the resource leak.
You can refer to the vulnerability details in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003001.json) for more information.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
