extcon: Modify extcon device to be created after driver data is set
Summary
GSD-2022-1003200: extcon: Modify extcon device to be created after driver data is set. Affects Kernel versions < 368e68ad6da4317fc4170e8d92b51c13d1bfe7a7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The extcon package is a part of the Linux Kernel ecosystem. It provides support for external connectors, allowing the system to detect and handle changes in the state of external devices. The extcon device is created during the initialization process and is responsible for managing the connection and disconnection events of external devices. However, in versions prior to v5.15.47 of the Linux Kernel, the extcon device was created before the driver data was set, which could lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability in the extcon package arises from the incorrect order of operations during device initialization. By creating the extcon device before setting the driver data, it is possible for an attacker to manipulate the device state and potentially exploit the system. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.15.47 by commit 368e68ad6da4317fc4170e8d92b51c13d1bfe7a7.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the extcon package in versions prior to v5.15.47 of the Linux Kernel is vulnerable to potential security issues due to the incorrect order of operations during device initialization. It is recommended to update the Linux Kernel to version v5.15.47 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The extcon package is a component of the Linux Kernel that handles external connector events and manages the state of external devices.
The impact of this vulnerability is currently unknown, as the attack plausibility has not been proven. However, it is important to apply the fix to ensure the security of the system.
To fix this vulnerability, update the Linux Kernel to version v5.15.47 or later.
No specific workarounds have been mentioned for this vulnerability.
For more details about this vulnerability, refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
