Refcount Leak in powerpc/xics Package
Summary
GSD-2022-1003976: powerpc/xics: fix refcount leak in icp_opal_init(). Affects Kernel versions < 53f3f7f73e609b934083f896cb7ca2c2cb009b9f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The powerpc/xics package is a component of the Linux Kernel, which is responsible for managing interrupt controllers on PowerPC systems. It provides the necessary functionality for handling interrupts and dispatching them to the appropriate handlers. The powerpc/xics package is a critical part of the kernel's infrastructure and is widely used in PowerPC-based systems. However, a vulnerability has been discovered in the package that can lead to a refcount leak in the icp_opal_init() function.
Vulnerability Detail
The vulnerability in the powerpc/xics package arises from a refcount leak in the icp_opal_init() function. This function is responsible for initializing the interrupt controller on PowerPC systems using the OPAL firmware interface. The refcount leak occurs when the function fails to properly release a reference to a data structure, leading to a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory resources, resulting in a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the powerpc/xics package in the Linux Kernel is vulnerable to a refcount leak in the icp_opal_init() function. This vulnerability can potentially lead to a denial-of-service condition. Users should update their kernel to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The powerpc/xics package is a component of the Linux Kernel that handles interrupt controllers on PowerPC systems.
The vulnerability can potentially lead to a denial-of-service condition by exhausting system memory resources.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix the vulnerability, update your Linux Kernel to version v4.14.283 or later.
The fixed version of the Linux Kernel can be obtained from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
