Vulnerability in spi-zynqmp-gqspi Package: Return -ENOMEM if dma_map_single Fails
Summary
GSD-2021-1000278: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails. Affects Kernel versions >= 1c26372e5aa9e53391a1f8fe0dc7cd93a7e5ba9e, < bad5a23cf2b477fa78b85fd392736dae09a1e818. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi-zynqmp-gqspi package is a component of the Linux Kernel ecosystem. It provides support for the General Purpose SPI controller found in Xilinx ZynqMP SoCs. This controller allows communication with various SPI devices connected to the system. The vulnerability in this package can lead to a denial-of-service condition due to a failure to handle memory allocation errors properly.
Vulnerability Detail
The vulnerability arises from a failure to handle the return value of the dma_map_single function. If this function fails to map a buffer for DMA transfer, it should return an error code. However, the affected code in spi-zynqmp-gqspi does not check the return value and continues execution, assuming the mapping was successful. This oversight can lead to subsequent operations attempting to access unmapped memory, resulting in system instability or crashes. An attacker could potentially exploit this vulnerability to cause a denial-of-service condition on a vulnerable system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in spi-zynqmp-gqspi package can lead to a denial-of-service condition on a vulnerable system. It is crucial to update to Linux Kernel version v5.12.4 or a later version to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
spi-zynqmp-gqspi is a component of the Linux Kernel that provides support for the General Purpose SPI controller in Xilinx ZynqMP SoCs. It enables communication with SPI devices connected to the system.
This vulnerability can lead to a denial-of-service condition on a vulnerable system due to improper handling of memory allocation errors. It can result in system instability or crashes.
An attacker can potentially exploit this vulnerability by triggering the failure of dma_map_single function and causing subsequent operations to access unmapped memory. This can lead to a denial-of-service condition on the affected system.
Yes, this vulnerability has been fixed in Linux Kernel version v5.12.4 by commit bad5a23cf2b477fa78b85fd392736dae09a1e818.
To mitigate this vulnerability, it is recommended to update to Linux Kernel version v5.12.4 or a later version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
