extcon: Modify extcon device to be created after driver data is set
Summary
GSD-2022-1003822: extcon: Modify extcon device to be created after driver data is set. Affects Kernel versions < cb81ea998c461868d1168411a867d8ffee12f23f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The extcon package is a component of the Linux Kernel that handles external connectors and their events. It provides a framework for managing the state of external connectors, such as USB ports or headphone jacks, and notifying the system when their state changes. The extcon device is created during the initialization of the driver and is responsible for handling events related to the external connector. However, in versions prior to v4.19.247 of the Linux Kernel, the extcon device was created before the driver data was set, potentially leading to uninitialized data access or other vulnerabilities.
Vulnerability Detail
The vulnerability in the extcon package arises from the incorrect order of operations during the initialization of the extcon device. By creating the extcon device before setting the driver data, uninitialized or incorrect data may be accessed or used, potentially leading to security vulnerabilities. The exact impact and attack plausibility of this vulnerability have not been proven, but it is considered a potential security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The extcon package in versions prior to v4.19.247 of the Linux Kernel has a vulnerability that could lead to uninitialized data access or other security vulnerabilities. To address this issue, it is recommended to update to Linux Kernel version v4.19.247 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The extcon package is a component of the Linux Kernel that handles external connectors and their events. It provides a framework for managing the state of external connectors, such as USB ports or headphone jacks, and notifying the system when their state changes.
The impact of this vulnerability is not yet proven, but it has the potential to lead to uninitialized data access or other security vulnerabilities.
To fix this vulnerability, you should update to Linux Kernel version v4.19.247 or later, which includes the necessary fix for the extcon package.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the Linux Kernel repository and the associated commit cb81ea998c461868d1168411a867d8ffee12f23f.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
