ARM: versatile: Add missing of_node_put in dcscb_init
Summary
GSD-2022-1003353: ARM: versatile: Add missing of_node_put in dcscb_init. Affects Kernel versions < 83c329b980bddbc8c6a3d287d91f2103a4d4a860. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ARM versatile package is a versatile platform for running Linux on ARM-based systems. It provides support for various ARM processors and boards. The dcscb_init function is a part of this package and is responsible for initializing the Device Configuration Space Control Block (DCSCB) for a specific device. The DCSCB is used to configure and control the device's configuration space. However, there is a missing of_node_put call in the dcscb_init function, which can lead to a reference count leak and potential resource exhaustion.
Vulnerability Detail
The missing of_node_put call in the dcscb_init function can result in a reference count leak, which can lead to resource exhaustion. An attacker could potentially exploit this vulnerability to exhaust system resources, causing a denial of service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the ARM versatile package is vulnerable to a missing of_node_put call in the dcscb_init function, which can result in a reference count leak and potential resource exhaustion. It is recommended to update to Linux Kernel version v5.15.46 or a later version to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is a potential denial of service (DoS) condition due to resource exhaustion.
The attacker can exploit this vulnerability by triggering the missing of_node_put call, causing a reference count leak and potential resource exhaustion.
There is no known proof-of-concept or exploit code available at the moment.
Yes, this vulnerability has been fixed in Linux Kernel version v5.15.46 by commit 83c329b980bddbc8c6a3d287d91f2103a4d4a860.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2022-1003353.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
