Memory Leak Vulnerability in drm/amd/pm Package
Summary
GSD-2022-1003512: drm/amd/pm: fix a potential gpu_metrics_table memory leak. Affects Kernel versions >= 95868b85764aff2dcbf78d3054076df75446ad15, < 222cebd995cdf11fe0d502749560f65e64990e55. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/pm package is a component of the Linux Kernel that handles power management for AMD GPUs. It provides functionality for controlling GPU performance and power consumption. The package is critical for proper functioning and optimization of AMD graphics cards.
Vulnerability Detail
The vulnerability in the drm/amd/pm package is related to a potential memory leak in the gpu_metrics_table. If not properly handled, this memory leak could lead to resource exhaustion and system instability. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected functionality by modifying the configuration settings of the drm/amd/pm package. However, this may result in reduced GPU performance or limited power management capabilities. It is strongly advised to apply the official fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in the drm/amd/pm package of the Linux Kernel could lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v5.10.88 or later to mitigate this vulnerability. Users can also utilize the Vulert Playground to check if their systems are affected and receive real-time vulnerability alerts. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially lead to resource exhaustion and system instability. An attacker could exploit it to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the tool will provide real-time alerts for open-source vulnerabilities.
No, this vulnerability was introduced in version v5.10 of the Linux Kernel. Versions prior to v5.10 are not affected.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is important to apply the fix promptly to mitigate any potential risks.
This vulnerability was discovered by the security research team at Vulert, a platform that specializes in monitoring and alerting for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
