Vulnerability in Kernel package: spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()
Summary
GSD-2021-1000432: spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware(). Affects Kernel versions >= 944c01a889d97dc08e1b71f4ed868f4023fd6034, < 4a01ad002d2e03c399af536562693752af7c81b1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices, including the Serial Peripheral Interface (SPI). The SPI subsystem allows communication between the kernel and SPI devices, enabling data transfer for peripherals such as sensors, displays, and memory chips. The fsl-lpspi module within the Kernel package specifically handles the Low Power SPI controller found in some Freescale/NXP processors. This vulnerability affects the lpspi_prepare_xfer_hardware() function within the fsl-lpspi module.
Vulnerability Detail
The vulnerability identified in the fsl-lpspi module is related to a reference leak in the lpspi_prepare_xfer_hardware() function. When preparing the hardware for data transfer, the function fails to release a power management (PM) reference, leading to a reference leak. This can result in resource exhaustion and potential denial-of-service (DoS) attacks. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the vulnerability in the Kernel package's fsl-lpspi module can lead to resource exhaustion and potential denial-of-service attacks. It is crucial to update the Linux Kernel package to version v5.4.119 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is resource exhaustion and potential denial-of-service (DoS) attacks. However, the actual impact and attack plausibility have not been proven yet.
The vulnerability was introduced in version v5.2 of the Linux Kernel package by commit 944c01a889d97dc08e1b71f4ed868f4023fd6034. It is fixed in version v5.4.119 and later by commit 4a01ad002d2e03c399af536562693752af7c81b1.
No, there is no specific workaround mentioned for this vulnerability. It is recommended to update the Kernel package to the fixed version.
You can find more details about this vulnerability in the Open Source Vulnerability database entry GSD-2021-1000432: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000432.json
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply upload your manifest file (e.g., package-lock.json) to the playground and it will provide information on any vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
