Vulnerability in Kernel package: Input: gpio-keys - cancel delayed work only in case of GPIO
Summary
GSD-2022-1003348: Input: gpio-keys - cancel delayed work only in case of GPIO. Affects Kernel versions < 96c460687813915dedca9dd7d04ae0e90607fd79. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system that provides the core functionality and interfaces between hardware and software. It includes various subsystems and drivers to manage different hardware components. One such subsystem is the gpio-keys, which handles input events from GPIO (General Purpose Input/Output) buttons. These buttons are commonly found on embedded systems and provide a way to interact with the device. However, a vulnerability has been discovered in the gpio-keys subsystem that can lead to potential security issues.
Vulnerability Detail
The vulnerability in the gpio-keys subsystem arises from the improper handling of delayed work cancellation. Specifically, the delayed work is canceled only in the case of GPIO, which can result in unexpected behavior and potential security risks. An attacker could potentially exploit this vulnerability to manipulate the delayed work mechanism and execute arbitrary code or disrupt the normal operation of the system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's gpio-keys subsystem, which can potentially lead to security risks. It is crucial to update the Kernel package to version v5.15.46 or a newer version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system that provides core functionality and interfaces between hardware and software.
The gpio-keys subsystem is responsible for handling input events from GPIO buttons, which are commonly found on embedded systems.
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to execute arbitrary code or disrupt the normal operation of the system.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.15.46 by commit 96c460687813915dedca9dd7d04ae0e90607fd79.
To fix this vulnerability, it is recommended to update the Kernel package to version v5.15.46 or any subsequent version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
