Vulnerability in Kernel Package: arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for bluetooth
Summary
GSD-2022-1002723: arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for bluetooth. Affects Kernel versions < e4c4de19ff48099531d66051de08f084a7d4dab9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services, such as device drivers, memory management, and process scheduling. The vulnerability in question affects the arm64 architecture and specifically the device tree source (DTS) files for the Qualcomm sc7280-idp platform. These files define the hardware configuration and settings for the Bluetooth module. The vulnerability arises from the improper configuration of the Clear To Send (CTS) pin, which should be set to bias-bus-hold for Bluetooth functionality.
Vulnerability Detail
The vulnerability in the Kernel package for the arm64 architecture on the Qualcomm sc7280-idp platform involves the misconfiguration of the CTS pin for Bluetooth. By not setting the CTS pin to bias-bus-hold, the Bluetooth module may experience unexpected behavior or fail to function correctly. This misconfiguration could potentially lead to security vulnerabilities, such as unauthorized access or data leakage. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Kernel package for the arm64 architecture on the Qualcomm sc7280-idp platform is vulnerable to a misconfiguration in the Bluetooth module's CTS pin. This vulnerability can potentially lead to security risks, although the impact and attack plausibility have not been proven. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.18.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially lead to security vulnerabilities in the Bluetooth functionality, such as unauthorized access or data leakage.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if the vulnerability is present.
Yes, a patch is available in the Linux Kernel version v5.18.3. Updating to this version will fix the vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is always recommended to apply security patches promptly to mitigate any potential risks.
You can find more information about this vulnerability in the GSD-2022-1002723 JSON report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002723.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
