Double Free Vulnerability in drm/amd/pm Package
Summary
GSD-2022-1004081: drm/amd/pm: fix double free in si_parse_power_table(). Affects Kernel versions < 2615464854505188f909d0c07c37a6623693b5c7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/pm package is a component of the Linux Kernel that handles power management for AMD graphics devices. It provides functionality for parsing power tables and managing power-related operations. The package is crucial for ensuring optimal performance and power efficiency of AMD graphics hardware.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1004081, is a double free issue in the si_parse_power_table() function of the drm/amd/pm package. This vulnerability could be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The double free occurs when the power table parsing function attempts to free a memory object that has already been freed, leading to memory corruption and potential system instability.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.9.318 or later. The fix for this issue was implemented in commit 2615464854505188f909d0c07c37a6623693b5c7 of the Linux Kernel repository. Updating to the latest stable version of the Linux Kernel ensures that the vulnerable code is replaced with the patched version, eliminating the double free vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality by preventing the loading of the drm/amd/pm module. This can be achieved by blacklisting the module or modifying the system's module configuration. However, it is strongly recommended to apply the official fix by updating the Linux Kernel as soon as possible.
Conclusion
The double free vulnerability in the drm/amd/pm package of the Linux Kernel can have serious consequences, including system instability and potential code execution with kernel privileges. It is crucial to promptly update the Linux Kernel to version v4.9.318 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges. Exploitation of this vulnerability could result in system instability and compromise the security of the affected system.
You can check if your system is affected by this vulnerability by examining the Linux Kernel version. If your system is running a version prior to v4.9.318, it is likely vulnerable. Additionally, you can use vulnerability monitoring tools like Vulert (https://vulert.com) to scan your system and identify any potential vulnerabilities.
Yes, a fix for this vulnerability is available in the Linux Kernel version v4.9.318 and later. It is recommended to update the Linux Kernel to the latest stable version to ensure the vulnerability is patched.
A temporary workaround is to disable the affected functionality by preventing the loading of the drm/amd/pm module. This can be achieved by blacklisting the module or modifying the system's module configuration. However, applying the official fix by updating the Linux Kernel is the recommended approach.
You can find more information about this vulnerability, including technical details and the fix commit, in the vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID is GSD-2022-1004081. The database can be accessed at https://github.com/cloudsecurityalliance/gsd-database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.