Vulnerability in coresight: cpu-debug Package
Summary
GSD-2022-1003856: coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier. Affects Kernel versions >= 2227b7c7463402ce92706a6f35c82cad6e8ee19a, < d7b69816ddeb7cecdd0543a89e844d6577951eb4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coresight: cpu-debug package is a component of the Linux Kernel ecosystem. It provides functionality related to CPU debugging and is responsible for handling panic notifications. The package utilizes a mutex for synchronization purposes. However, a vulnerability has been identified in the package, which could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the coresight: cpu-debug package involves the use of a mutex instead of mutex_trylock on the panic notifier. This vulnerability was introduced in version v4.13 of the Linux Kernel by commit 2227b7c7463402ce92706a6f35c82cad6e8ee19a and was fixed in version v4.19.247 by commit d7b69816ddeb7cecdd0543a89e844d6577951eb4. The impact and attack plausibility of this vulnerability have not been proven yet. However, it is important to address this issue to prevent potential security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the coresight: cpu-debug package in the Linux Kernel is vulnerable to a mutex-related issue. It is recommended to update the kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The coresight: cpu-debug package is a component of the Linux Kernel ecosystem that provides functionality related to CPU debugging and handles panic notifications.
The impact of this vulnerability is currently unknown, as the actual attack plausibility and consequences have not been proven.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.247 or later by pulling the latest changes from the official Linux Kernel repository.
No specific workaround has been mentioned for this vulnerability.
For more information about this vulnerability, you can refer to the vulnerability details in the Open Source Vulnerability format provided by the Cloud Security Alliance's GSD database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
