Vulnerability in Linux Kernel: Input: stmfts - do not leave device disabled in stmfts_input_open
Summary
GSD-2022-1003762: Input: stmfts - do not leave device disabled in stmfts_input_open. Affects Kernel versions >= 8c015cd524424e79b31270bd3dbdac9612c6f7db, < c8735252f93fdb7a68b9cd5332dbc52ebd2fd25b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for the operating system, including device drivers, memory management, and process scheduling. The stmfts_input_open function is a part of the kernel's input subsystem and is responsible for handling input devices. This vulnerability specifically affects the stmfts driver, which is used for touchscreens. The vulnerability allows an attacker to leave the device disabled, potentially leading to a denial-of-service condition or other security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the stmfts_input_open function of the Linux Kernel. When a user opens an stmfts input device, the function fails to properly enable the device, leaving it disabled. This can be exploited by an attacker to disable the device, causing a denial-of-service condition or potentially bypassing security measures that rely on the device's input. The impact and attack plausibility of this vulnerability have not been proven yet, but it is important to address it to ensure the integrity and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the stmfts driver by blacklisting it. This can be done by adding the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist stmfts
After adding the line, the system needs to be rebooted for the changes to take effect. However, it is recommended to apply the official fix by updating the Linux Kernel to the patched version.
Conclusion
The vulnerability in the Linux Kernel's stmfts driver can potentially lead to a denial-of-service condition or bypassing of security measures. It is crucial to update the Linux Kernel to the patched version (v5.4.198 or later) to mitigate this vulnerability. Alternatively, users can apply a workaround by blacklisting the stmfts driver. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for the operating system, including device drivers, memory management, and process scheduling.
The stmfts driver is a part of the Linux Kernel's input subsystem and is responsible for handling input devices, specifically touchscreens.
The impact of this vulnerability can vary depending on the system's configuration and usage. It can potentially lead to a denial-of-service condition or bypassing of security measures that rely on the affected input device.
To fix this vulnerability, users should update their Linux Kernel to version v5.4.198 or later. This can be done by downloading the updated kernel source code from the official Linux Kernel repository and compiling it according to the provided instructions.
Yes, a workaround is available. Users can disable the stmfts driver by blacklisting it. This can be done by adding a line to the /etc/modprobe.d/blacklist.conf file and rebooting the system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
