Vulnerability in iommu/mediatek Package: Remove clk_disable in mtk_iommu_remove
Summary
GSD-2022-1002692: iommu/mediatek: Remove clk_disable in mtk_iommu_remove. Affects Kernel versions >= b34ea31fe013569d42b7e8681ef3f717f77c5b72, < 6eaa046c696c83542c56765cdde564d9818ff1fb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iommu/mediatek package is a component of the Linux Kernel that provides support for the MediaTek IOMMU (Input-Output Memory Management Unit) hardware. The IOMMU is responsible for managing memory access between devices and the CPU, ensuring secure and efficient data transfers. The mtk_iommu_remove function is a part of this package and is used to remove the MediaTek IOMMU device. However, a vulnerability has been discovered in this function that involves the improper handling of clock disabling, which could lead to potential security issues.
Vulnerability Detail
The vulnerability in the iommu/mediatek package arises from the presence of clk_disable in the mtk_iommu_remove function. This function is responsible for removing the MediaTek IOMMU device, but it fails to properly handle the disabling of clocks. This oversight could allow an attacker to manipulate the clock state, potentially leading to unauthorized access or other security breaches. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.18.3 by commit 6eaa046c696c83542c56765cdde564d9818ff1fb. However, it was introduced in version v5.13 by commit b34ea31fe013569d42b7e8681ef3f717f77c5b72.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the iommu/mediatek package involving the improper handling of clock disabling in the mtk_iommu_remove function has been identified. It is crucial to update the Linux Kernel to version v5.18.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The iommu/mediatek package is a component of the Linux Kernel that provides support for the MediaTek IOMMU hardware, which manages memory access between devices and the CPU.
The mtk_iommu_remove function is a part of the iommu/mediatek package and is responsible for removing the MediaTek IOMMU device.
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to manipulate the clock state and gain unauthorized access or perform other security breaches.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.18.3 or later by downloading the latest kernel source code and compiling it.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
