Vulnerability in Kernel: bus: qcom: Put child node before return
Summary
GSD-2021-1000387: bus: qcom: Put child node before return. Affects Kernel versions >= 335a127548081322bd2b294d715418648912f20c, < 00f6abd3509b1d70d0ab0fbe65ce5685cebed8be. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services for the proper functioning of the system. The bus subsystem in the Kernel handles device communication and configuration. The Qualcomm (qcom) bus driver is responsible for managing Qualcomm-specific devices. This vulnerability specifically affects the qcom bus driver in the Kernel.
Vulnerability Detail
The vulnerability in the qcom bus driver arises from a missing 'put' operation on a child node before returning from a function. This omission can lead to a reference count leak, potentially causing memory leaks and resource exhaustion. An attacker may be able to exploit this vulnerability to trigger a denial-of-service condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in Kernel version v4.9 and has been fixed in version v5.10.37.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to manually apply the fix commit (00f6abd3509b1d70d0ab0fbe65ce5685cebed8be) to the affected Kernel version. This can be done by obtaining the patch for the fix commit and applying it to the Kernel source code. However, it is strongly recommended to update to the latest stable Kernel version as soon as possible.
Conclusion
The vulnerability in the qcom bus driver of the Kernel can lead to memory leaks, resource exhaustion, and potential exploitation by attackers. It is crucial to update the Kernel to version v5.10.37 or later to fix this vulnerability. If immediate updating is not possible, applying the provided fix commit manually can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to memory leaks and resource exhaustion, which may result in a denial-of-service condition or allow an attacker to execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to apply the fix or update the Kernel to prevent potential exploitation.
While updating the Kernel is the recommended solution, you can apply the workaround mentioned in this report to manually fix the vulnerability in the affected Kernel version. However, it is essential to update to the latest stable Kernel version as soon as possible.
You can find more information about this vulnerability, including the fix commit and affected Kernel versions, in the vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID is GSD-2021-1000387.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
