Vulnerability in Kernel package: interconnect: qcom: bcm-voter
Summary
GSD-2021-1000584: interconnect: qcom: bcm-voter: add a missing of_node_put(). Affects Kernel versions >= 976daac4a1c581e5d5fd64047519fd6fcde39738, < 4e3cea8035b6f1b9055e69cc6ebf9fa4e50763ae. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the core functionalities and communication between hardware and software. The interconnect subsystem within the Kernel facilitates communication between different components of the system. One specific module, qcom: bcm-voter, is used for managing voting on interconnect paths for Broadcom SoCs. This module ensures fair resource allocation and efficient communication. However, a vulnerability has been identified in this module that could potentially lead to security breaches and system instability.
Vulnerability Detail
The vulnerability in the qcom: bcm-voter module arises from a missing of_node_put() function call. This omission can result in a reference count leak, leading to resource exhaustion and potential memory corruption. An attacker could exploit this vulnerability to gain unauthorized access, execute arbitrary code, or cause denial-of-service conditions. The impact and attack plausibility of this vulnerability have not been proven yet. It is crucial to address this issue promptly to mitigate potential risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the Kernel package to the latest version available.
Conclusion
The vulnerability in the Kernel package's interconnect module, specifically in the qcom: bcm-voter module, poses potential risks to system security and stability. It is crucial to update the Kernel package to version v5.10.42 or later to address this vulnerability. By applying the recommended fix, the system can be protected against unauthorized access, code execution, and denial-of-service attacks. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow attackers to gain unauthorized access, execute arbitrary code, or cause denial-of-service conditions. However, the actual impact and attack plausibility have not been proven yet.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to update the Kernel package to the latest version to ensure the vulnerability is patched.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000584.json
For further support on vulnerability remediation, you can reach out to info@devnack.com. They will provide assistance and guidance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
