Vulnerability in i2c: imx Package - Reference Leak when pm_runtime_get_sync Fails
Summary
GSD-2021-1000354: i2c: imx: fix reference leak when pm_runtime_get_sync fails. Affects Kernel versions >= 3a5ee18d2a32bda6b9a1260136f6805848e3839d, < 3a0cdd336d92c429b51a79bf4f64b17eafa0325d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The i2c: imx package is a component of the Linux Kernel, which is responsible for managing the Inter-Integrated Circuit (I2C) bus on i.MX platforms. The I2C bus is a popular communication protocol used for connecting various devices in embedded systems. The i2c: imx package provides the necessary drivers and functionality for I2C communication on i.MX-based devices. However, a vulnerability has been discovered in this package that can lead to a reference leak when the pm_runtime_get_sync function fails.
Vulnerability Detail
The vulnerability in the i2c: imx package occurs when the pm_runtime_get_sync function fails. This function is responsible for managing the power state of the device during runtime. When the function fails, it can result in a reference leak, which can lead to resource exhaustion and potential denial-of-service attacks. An attacker could exploit this vulnerability by repeatedly triggering the failure of the pm_runtime_get_sync function, causing the system to exhaust its resources and become unresponsive. This vulnerability was introduced in version v5.7 of the Linux Kernel and has been fixed in version v5.10.37.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.37 or later. This update includes the necessary patch to address the reference leak issue. Users can obtain the updated kernel from the official Linux Kernel repository. After updating the kernel, it is advisable to restart the system to ensure the changes take effect.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by applying the recommended fix and updating to the latest version of the Linux Kernel.
Conclusion
The vulnerability in the i2c: imx package, which causes a reference leak when the pm_runtime_get_sync function fails, can lead to resource exhaustion and potential denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.10.37 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The i2c: imx package is a component of the Linux Kernel that provides drivers and functionality for managing the I2C bus on i.MX platforms.
The pm_runtime_get_sync function is responsible for managing the power state of a device during runtime in the Linux Kernel.
A reference leak occurs when a program fails to release a reference to a resource, leading to resource exhaustion and potential denial-of-service attacks.
This vulnerability can result in resource exhaustion and potential denial-of-service attacks, as an attacker could exploit the reference leak to exhaust system resources.
To update the Linux Kernel, users can obtain the latest version from the official Linux Kernel repository and follow the installation instructions provided.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.