Vulnerability in spi-zynqmp-gqspi Package: Return -ENOMEM if dma_map_single Fails
Summary
GSD-2021-1000378: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails. Affects Kernel versions >= 1c26372e5aa9e53391a1f8fe0dc7cd93a7e5ba9e, < 5980a3b9c933408bc22b0e349b78c3ebd7cbf880. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi-zynqmp-gqspi package is a component of the Linux Kernel ecosystem. It provides support for the General Purpose SPI controller found in Xilinx ZynqMP SoCs. This controller allows communication with external devices using the SPI protocol. The vulnerability in this package relates to the handling of memory allocation failures during the mapping of DMA buffers.
Vulnerability Detail
The vulnerability in spi-zynqmp-gqspi arises when the dma_map_single function fails to map a DMA buffer. Instead of returning an appropriate error code, the function does not handle the failure and continues execution. This can lead to subsequent operations using the unmapped buffer, resulting in undefined behavior, memory corruption, or system crashes. The impact of this vulnerability depends on the specific usage scenario and the attacker's ability to exploit the resulting memory corruption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk.
Conclusion
In conclusion, the spi-zynqmp-gqspi package in the Linux Kernel is vulnerable to a memory corruption issue when handling DMA buffer mapping failures. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.10.37 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
spi-zynqmp-gqspi is a package in the Linux Kernel ecosystem that provides support for the General Purpose SPI controller in Xilinx ZynqMP SoCs.
The impact of this vulnerability can vary depending on the specific usage scenario and the attacker's ability to exploit resulting memory corruption. It could lead to undefined behavior, memory corruption, or system crashes.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.37 or later, which includes the necessary fix for the spi-zynqmp-gqspi package.
No, there is no known workaround for this vulnerability. Updating the Linux Kernel is the recommended solution.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2021-1000378.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
