Refcount Leak in imx_sc_thermal_probe in Kernel
Summary
GSD-2022-1003346: thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe. Affects Kernel versions >= e20db70dba1c0783b9878ce37171ad560b1ebaf3, < 3ade442ea5d3512a3c67984489ab4d8a6fb3b29f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages communication between hardware and software. It provides essential services and functions to enable the proper functioning of the system. The imx_sc_thermal_probe is a thermal driver in the Kernel specifically designed for the i.MX System Controller (SC) thermal management. It is responsible for monitoring and controlling the thermal behavior of the i.MX SC. However, a vulnerability has been identified in the imx_sc_thermal_probe driver, which can lead to a refcount leak.
Vulnerability Detail
The vulnerability in the imx_sc_thermal_probe driver results in a refcount leak. This means that the driver fails to properly release references to resources, leading to a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory, causing a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.15.46 by commit 3ade442ea5d3512a3c67984489ab4d8a6fb3b29f. However, it was introduced in version v5.7 by commit e20db70dba1c0783b9878ce37171ad560b1ebaf3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The imx_sc_thermal_probe driver in the Kernel is vulnerable to a refcount leak, which can potentially lead to a denial-of-service (DoS) condition. It is crucial to update the Linux Kernel to version v5.15.46 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, it could potentially lead to a denial-of-service (DoS) condition by exhausting system memory.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it in real-time.
Yes, this vulnerability has been fixed in Linux Kernel version v5.15.46 by commit 3ade442ea5d3512a3c67984489ab4d8a6fb3b29f.
No specific workaround has been mentioned for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
You can refer to the vulnerability details in the Open Source Vulnerability format provided by the Cloud Security Alliance's GSD database. The link to the details is available in the references section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
