Vulnerability in Kernel package: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
Summary
GSD-2022-1003323: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup. Affects Kernel versions >= d10715be03bd8bad59ddc50236cb140c3bd73c7b, < f2dfb4ab887d67be7d0892ba041d3c8d738d3356. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functions and providing an interface between hardware and software. It includes various subsystems, including the video subsystem, which handles display-related operations. One of the video subsystem components is fbdev, which provides a generic framebuffer device interface. Within fbdev, the clcdfb driver is responsible for supporting certain types of display controllers. However, a vulnerability has been identified in the clcdfb_of_vram_setup function, which can lead to a refcount leak. This vulnerability was introduced in version v3.17 of the Linux Kernel and has been fixed in version v5.15.46.
Vulnerability Detail
The vulnerability in the clcdfb_of_vram_setup function of the clcdfb driver can result in a refcount leak. This can potentially lead to resource exhaustion and impact the stability and performance of the system. An attacker may be able to exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code with elevated privileges. The vulnerability was introduced in version v3.17 of the Linux Kernel and has been fixed in version v5.15.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel package is not immediately feasible, a possible workaround is to disable the affected functionality. This can be achieved by blacklisting the clcdfb driver module. The specific steps to blacklist the module may vary depending on the Linux distribution in use. Here is an example of how to blacklist the clcdfb module in a Debian-based distribution:
- Open the file '/etc/modprobe.d/blacklist.conf' in a text editor.
- Add the following line at the end of the file: 'blacklist clcdfb'
- Save the file and reboot the system.
Please note that this workaround disables the functionality provided by the clcdfb driver, which may impact the use of certain display controllers.
Conclusion
In conclusion, the Kernel package is vulnerable to a refcount leak in the clcdfb_of_vram_setup function, which can lead to resource exhaustion and potential code execution with elevated privileges. It is recommended to update the Kernel package to version v5.15.46 or later to fix this vulnerability. If immediate update is not possible, a temporary workaround is to blacklist the clcdfb driver module. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to resource exhaustion, system instability, and may allow an attacker to execute arbitrary code with elevated privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in version v5.15.46 of the Linux Kernel. It is recommended to update to this version or later to fix the vulnerability.
Yes, a possible temporary measure is to blacklist the clcdfb driver module. This can be done by adding 'blacklist clcdfb' to the '/etc/modprobe.d/blacklist.conf' file and rebooting the system. However, this workaround disables the functionality provided by the clcdfb driver.
You can find more information about this vulnerability in the GSD-2022-1003323 entry of the GSD Database, available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003323.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
