Vulnerability in drm/msm/mdp5 Package: Return Error Code in mdp5_pipe_release when Deadlock is Detected
Summary
GSD-2022-1003409: drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected. Affects Kernel versions >= 7907a0d77cb461f58045763c205a5830be72e97c, < 04bef5f1ba8ea6d7c1c8f5f65e0395c62db59cb8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/msm/mdp5 package is a component of the Linux Kernel that provides support for display and graphics functionality on Qualcomm Adreno GPUs. It includes the mdp5_pipe_release function, which is responsible for releasing resources associated with a display pipeline. However, a vulnerability has been discovered in this function that can lead to a deadlock condition.
Vulnerability Detail
The vulnerability in the mdp5_pipe_release function occurs when a deadlock is detected. Instead of returning an error code to indicate the deadlock, the function does not provide any feedback, which can result in a system hang or crash. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition on a vulnerable system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Linux Kernel to the patched version.
Conclusion
The vulnerability in the drm/msm/mdp5 package can lead to a system hang or crash when a deadlock is detected in the mdp5_pipe_release function. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.15.46 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a system hang or crash, resulting in a denial-of-service (DoS) condition.
An attacker can exploit this vulnerability by triggering the deadlock condition in the mdp5_pipe_release function, causing the system to hang or crash.
This vulnerability was introduced in version v4.18 of the Linux Kernel and is present in all versions until v5.15.45.
Yes, the vulnerability has been fixed in Linux Kernel version v5.15.46 by commit 04bef5f1ba8ea6d7c1c8f5f65e0395c62db59cb8.
No, there are no known workarounds for this vulnerability. It is crucial to update the Linux Kernel to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
