Vulnerability in i2c: stm32f7 Package - Reference Leak when pm_runtime_get_sync Fails
Summary
GSD-2021-1000351: i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails. Affects Kernel versions >= ea6dd25deeb5b797a145be7f860e3085e7d104c3, < c323b270a52a26aa8038a4d1fd9a850904a41166. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The i2c: stm32f7 package is a component of the Linux Kernel, specifically designed for STM32F7 microcontrollers. It provides support for the Inter-Integrated Circuit (I2C) protocol, allowing communication between various peripherals and devices. The package is responsible for managing the I2C bus and facilitating data transfer between connected devices. However, a vulnerability has been identified in this package that can lead to a reference leak when the pm_runtime_get_sync function fails.
Vulnerability Detail
The vulnerability in the i2c: stm32f7 package occurs when the pm_runtime_get_sync function fails. This function is responsible for managing the power state of the device and ensuring it is in sync with the runtime power management framework. When the function fails, a reference leak occurs, leading to a potential resource exhaustion issue. An attacker could exploit this vulnerability to exhaust system resources, potentially causing a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The i2c: stm32f7 package in the Linux Kernel is vulnerable to a reference leak issue when the pm_runtime_get_sync function fails. This vulnerability can potentially lead to resource exhaustion and a denial-of-service condition. It is recommended to update the Kernel to version v5.10.37 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The i2c: stm32f7 package is a component of the Linux Kernel that provides support for the I2C protocol on STM32F7 microcontrollers.
The impact of this vulnerability is a potential resource exhaustion issue, which could lead to a denial-of-service condition.
An attacker could exploit this vulnerability by triggering the reference leak, causing resource exhaustion and potentially disrupting the system's normal operation.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix this vulnerability, update the Linux Kernel to version v5.10.37 or later, which includes the necessary fix for the reference leak issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
