m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
Summary
GSD-2021-1000287: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits. Affects Kernel versions >= 7529b90d051e4629884771ba2b1d3a87d2c6a9d7, < 5d34225169346cab5145978d153b9ce90e9ace21. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The m68k is a family of 16/32-bit microprocessors developed by Motorola. The mvme147 and mvme16x are specific models within this family. These microprocessors are commonly used in embedded systems and industrial applications. The PCC (Processor Configuration Control) timer is a feature that allows the configuration of various timer settings. However, a vulnerability exists in the code that handles the PCC timer configuration bits, which can lead to unintended wiping of these bits.
Vulnerability Detail
The vulnerability arises from a code implementation issue in the mvme147 and mvme16x m68k processors. When configuring the PCC timer, certain bits are inadvertently wiped, leading to incorrect timer settings. This can result in various issues, such as inaccurate timing measurements, incorrect scheduling of tasks, or malfunctioning of time-sensitive operations. An attacker could potentially exploit this vulnerability to manipulate timing-related operations and disrupt the normal functioning of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to manually modify the code responsible for handling the PCC timer configuration bits. By carefully reviewing the code and ensuring that the necessary bits are not wiped, the vulnerability can be mitigated. However, this approach requires a deep understanding of the codebase and should be performed with caution.
Conclusion
The mvme147 and mvme16x m68k processors are vulnerable to a code implementation issue that can result in unintended wiping of PCC timer configuration bits. This vulnerability can lead to various timing-related issues and potential system disruption. It is crucial to update the Linux Kernel to version v5.12.4 or later to fix this vulnerability. If immediate update is not feasible, manual code modification can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to inaccurate timing measurements, incorrect task scheduling, or malfunctioning of time-sensitive operations. This can disrupt the normal functioning of the system and potentially be exploited by attackers.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to promptly apply the recommended fix to mitigate any potential risks.
This vulnerability requires local access to the system in order to manipulate the PCC timer configuration bits. Therefore, it cannot be directly exploited remotely. However, if an attacker gains local access, they could potentially exploit this vulnerability to disrupt system operations.
The primary mitigation for this vulnerability is to update the Linux Kernel to the recommended version. However, if immediate kernel update is not possible, the workaround mentioned earlier can be considered. It is important to note that modifying the code manually requires expertise and should be done with caution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
