Vulnerability in ARM: hisi package - Missing of_node_put after of_find_compatible_node
Summary
GSD-2022-1003050: ARM: hisi: Add missing of_node_put after of_find_compatible_node. Affects Kernel versions < cafaaae4bb9ce84a2791fa29bf6907a9466c3883. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ARM: hisi package is a component of the Linux Kernel, which is responsible for supporting ARM-based Hisilicon SoCs. It provides necessary drivers and functionalities for these specific hardware platforms. The package interacts with the device tree to identify compatible nodes for the Hisilicon SoCs. However, a vulnerability has been discovered in the package, which results in a missing of_node_put after of_find_compatible_node function call.
Vulnerability Detail
The vulnerability in the ARM: hisi package arises due to the missing of_node_put function call after the of_find_compatible_node function. This omission can lead to a reference count leak, causing a potential resource exhaustion issue. An attacker could exploit this vulnerability to exhaust system resources, resulting in a denial-of-service (DoS) condition. The impact of this vulnerability may vary depending on the specific usage scenario and the attacker's capabilities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to apply the recommended fix by updating the Linux Kernel to the patched version.
Conclusion
In conclusion, the ARM: hisi package in the Linux Kernel is vulnerable to a missing of_node_put issue, which can result in a resource exhaustion condition. It is crucial to update the Linux Kernel to version v5.17.14 or later to address this vulnerability. Promptly applying the recommended fix will help mitigate potential risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific usage scenario and the attacker's capabilities. However, it can potentially lead to a denial-of-service (DoS) condition by exhausting system resources.
To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.17.14 or later, which includes the necessary fix.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always advisable to apply security patches promptly to mitigate potential risks.
No, a CVSS score is not provided in the available information for this vulnerability.
For more information about this vulnerability, you can refer to the source link provided in the database-specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
