Null Return Check Vulnerability in soc: ti: ti_sci_pm_domains
Summary
GSD-2022-1003356: soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc. Affects Kernel versions < 7cef9274fa1b8506949d74bc45aef072b890824a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The soc: ti: ti_sci_pm_domains package is a component of the Linux Kernel, specifically designed for Texas Instruments (TI) System Control Interface (SCI) Power Management (PM) Domains. It provides functions and utilities for managing power domains in TI SoCs. These power domains control the power supply to various components of the system, allowing for efficient power management and optimization.
Vulnerability Detail
The vulnerability in soc: ti: ti_sci_pm_domains arises from a missing null return check in the devm_kcalloc function. This function is responsible for allocating memory for an array of objects with a specified size. Without the null return check, if the allocation fails, the program may continue execution with a null pointer, leading to potential crashes, memory corruption, or other undefined behavior. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to manually add a null return check in the affected code. Here is an example of how the check can be implemented:
/* Before */
ptr = devm_kcalloc(dev, count, sizeof(*ptr), GFP_KERNEL);
/* After */
ptr = devm_kcalloc(dev, count, sizeof(*ptr), GFP_KERNEL);
if (!ptr) {
/* Handle allocation failure */
return -ENOMEM;
}
Conclusion
In conclusion, the soc: ti: ti_sci_pm_domains package in the Linux Kernel is vulnerable to a null return check issue in the devm_kcalloc function. This vulnerability can lead to crashes, memory corruption, and potential code execution or DoS attacks. It is crucial to update the kernel to version v5.15.46 or later to mitigate the vulnerability. If immediate update is not possible, a temporary workaround involving a manual null return check can be implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to crashes, memory corruption, or other undefined behavior. It may also allow attackers to execute arbitrary code or cause a denial-of-service (DoS) condition.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended patch or update to prevent any potential exploitation.
The vulnerability is present in versions of the soc: ti: ti_sci_pm_domains package prior to Linux Kernel v5.15.46. It is recommended to update to the latest version to ensure the vulnerability is addressed.
While updating the Linux Kernel is the recommended solution, a temporary workaround is available by manually adding a null return check in the affected code. However, this workaround is not a permanent fix and may not provide the same level of security as the updated kernel.
More information about the fix can be found in the commit 7cef9274fa1b8506949d74bc45aef072b890824a of the Linux Kernel repository. The vulnerability details are available in the Open Source Vulnerability database with ID GSD-2022-1003356.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
