Vulnerability in mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
Summary
GSD-2022-1002569: mips: cpc: Fix refcount leak in mips_cpc_default_phys_base. Affects Kernel versions < aae6b4bb63c694bc91714412718f15468407fe51. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mips package is a part of the Linux Kernel ecosystem. It provides support for the MIPS architecture, which is commonly used in embedded systems and networking devices. The mips_cpc_default_phys_base function is responsible for managing the physical base address of the MIPS Co-Processor Cluster (CPC). This vulnerability in the function leads to a refcount leak, which can result in resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability in mips_cpc_default_phys_base allows an attacker to cause a refcount leak, leading to resource exhaustion. By repeatedly triggering this vulnerability, an attacker can consume all available resources, causing the system to become unresponsive. This can result in a denial-of-service condition, impacting the availability of the affected system. The vulnerability has been fixed in Linux Kernel version v5.18.4 by commit aae6b4bb63c694bc91714412718f15468407fe51.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Linux Kernel.
Conclusion
The vulnerability in mips_cpc_default_phys_base can lead to resource exhaustion and denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.18.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource exhaustion and potential denial-of-service attacks, impacting the availability of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is necessary to update the Linux Kernel to apply the fix.
More information about the fix can be found in the Linux Kernel repository. You can access the repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aae6b4bb63c694bc91714412718f15468407fe51.
To update the Linux Kernel, you can pull the latest changes from the official Linux Kernel repository and rebuild the kernel. Alternatively, you can wait for your Linux distribution to release an updated package containing the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
