Memory Leak Vulnerability in drm: msm Package
Summary
GSD-2022-1003906: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set(). Affects Kernel versions >= e172d10a9c4acc69bb07cbe9142ded2df791ff1f, < f8cd192752a1f613b14eee77783c6f0aebb49691. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm: msm package is a component of the Linux Kernel that provides support for display controllers found in Qualcomm Snapdragon SoCs. It includes drivers for managing display pipelines, such as the MDP (Mobile Display Processor) and CRTC (Cathode Ray Tube Controller). These drivers are responsible for handling various display-related tasks, including cursor rendering. The vulnerability in question affects the mdp5_crtc_cursor_set() function within the msm driver, which is responsible for setting the cursor image on the display. This function has a potential memory leak issue that could lead to resource exhaustion and system instability.
Vulnerability Detail
The vulnerability arises from a possible memory leak in the mdp5_crtc_cursor_set() function of the drm: msm package. When this function is called to set the cursor image, it may fail to release allocated memory in certain error scenarios. This can result in a gradual accumulation of unreleased memory, leading to resource exhaustion and potential system crashes. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by applying the recommended fix mentioned above.
Conclusion
In conclusion, the memory leak vulnerability in the drm: msm package can potentially lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to the recommended version or later to mitigate the risk. Users can refer to the provided source link for more information and apply the fix accordingly. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and potential system crashes, which may result in a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code with elevated privileges.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the recommended fix to mitigate the risk.
The exact attack vectors and exploitability of this vulnerability have not been proven yet. However, remote exploitation may be possible depending on the specific system configuration and network accessibility.
For more details about this vulnerability, including its technical aspects and the specific code changes introduced to fix it, you can refer to the source link provided in the vulnerability details section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
