Vulnerability in phy: qcom-qmp package - Fix Reset-Controller Leak on Probe Errors
Summary
GSD-2022-1003722: phy: qcom-qmp: fix reset-controller leak on probe errors. Affects Kernel versions >= e78f3d15e115e8e764d4b1562b4fa538f2e22f6b, < 7ac21b24af859c097eb4034e93430056068f8f31. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The phy: qcom-qmp package is a component of the Linux Kernel ecosystem. It provides support for Qualcomm QMP (Qualcomm Message Parser) PHYs, which are responsible for managing communication between the SoC (System-on-Chip) and external devices. These PHYs play a crucial role in establishing and maintaining reliable connections. However, a vulnerability has been discovered in the package that can lead to a reset-controller leak when probe errors occur.
Vulnerability Detail
The vulnerability in the phy: qcom-qmp package arises from a reset-controller leak that occurs during probe errors. When the package encounters errors during the initialization process, it fails to properly release the reset-controller, resulting in a resource leak. This vulnerability can have various ramifications, including potential resource exhaustion, system instability, and potential privilege escalation if exploited. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.198 or later. The fix for this issue was implemented in commit 7ac21b24af859c097eb4034e93430056068f8f31. Updating to the latest version of the Linux Kernel ensures that the reset-controller leak on probe errors is properly addressed.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the phy: qcom-qmp package that causes a reset-controller leak on probe errors can have significant implications for system stability and security. It is crucial to update the Linux Kernel to the recommended version or later to address this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The phy: qcom-qmp package is a component of the Linux Kernel ecosystem that provides support for Qualcomm QMP PHYs, facilitating communication between the SoC and external devices.
A reset-controller leak refers to a situation where a reset-controller fails to release resources properly, leading to resource leaks and potential system instability.
Probe errors occur during the initialization process of a device or component. They indicate failures or issues encountered while probing and configuring the device.
The vulnerability can result in resource exhaustion, system instability, and potential privilege escalation if exploited.
To fix this vulnerability, update the Linux Kernel to version v5.4.198 or later, which includes the necessary fix for the reset-controller leak on probe errors.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.