Double Free Vulnerability in drm/amd/pm Package
Summary
GSD-2022-1003395: drm/amd/pm: fix double free in si_parse_power_table(). Affects Kernel versions < a5ce7051db044290b1a95045ff03c249005a3aa4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/pm package is a component of the Linux Kernel that handles power management for AMD graphics cards. It provides functionality for parsing power tables and managing power-related operations. This package is critical for proper functioning and performance of AMD graphics cards on Linux systems.
Vulnerability Detail
The double free vulnerability in si_parse_power_table() function of the drm/amd/pm package allows an attacker to exploit a memory management issue. By sending specially crafted input, an attacker can trigger a double free condition, leading to memory corruption and potential code execution. This vulnerability can be exploited remotely, and if successful, an attacker may gain unauthorized access, escalate privileges, or cause a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version as soon as possible.
Conclusion
The double free vulnerability in the drm/amd/pm package of the Linux Kernel can lead to memory corruption and potential code execution. It is crucial to update the Linux Kernel to the fixed version to mitigate the risks associated with this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can be exploited remotely and may allow an attacker to gain unauthorized access, escalate privileges, or cause a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for this vulnerability. However, it is crucial to update the Linux Kernel to the fixed version to mitigate any potential risks.
No, updating the Linux Kernel to the fixed version is the only known solution to address this vulnerability. It is recommended to apply the necessary updates as soon as possible.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
