Vulnerability in ARM: hisi Package - Missing of_node_put after of_find_compatible_node
Summary
GSD-2022-1003570: ARM: hisi: Add missing of_node_put after of_find_compatible_node. Affects Kernel versions < 21a3effe446dd6dc5eed7fe897c2f9b88c9a5d6d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ARM: hisi package is a component of the Linux Kernel, which is responsible for supporting ARM-based Hisilicon SoCs. It provides necessary functionalities and drivers for these specific system-on-chips. The vulnerability in question arises from a missing of_node_put function call after of_find_compatible_node. This vulnerability has the potential to lead to security issues and system instability.
Vulnerability Detail
The vulnerability in the ARM: hisi package occurs due to the absence of an of_node_put function call after of_find_compatible_node. This missing call can result in a reference count leak, leading to memory leaks and potential use-after-free vulnerabilities. Attackers may exploit this vulnerability to execute arbitrary code, escalate privileges, or cause denial-of-service conditions. It is crucial to address this vulnerability promptly to ensure the security and stability of affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually add the missing of_node_put call after the of_find_compatible_node function. Here is an example of how to implement the fix:
// Add missing of_node_put after of_find_compatible_node
struct device_node *node;
node = of_find_compatible_node(NULL, NULL, "vendor,compatible-device");
if (node) {
// Perform necessary operations
of_node_put(node);
}
Please note that this workaround is not a permanent solution and should be replaced with the official fix as soon as possible.
Conclusion
The vulnerability in the ARM: hisi package, caused by the missing of_node_put call after of_find_compatible_node, can have severe security implications and system instability. It is recommended to update the Linux Kernel to version v5.10.121 or later, which includes the necessary fix. Alternatively, developers can apply the provided workaround until the official fix is implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to memory leaks, use-after-free vulnerabilities, and potential security breaches. Attackers may exploit this vulnerability to execute arbitrary code, escalate privileges, or cause denial-of-service conditions.
Systems utilizing the ARM: hisi package in the Linux Kernel are affected by this vulnerability. It specifically impacts ARM-based Hisilicon SoCs.
Yes, this vulnerability has been fixed in Linux Kernel version v5.10.121 by commit 21a3effe446dd6dc5eed7fe897c2f9b88c9a5d6d.
If you are using an affected version of the Linux Kernel, it is recommended to update to version v5.10.121 or later. Apply the official fix provided in commit 21a3effe446dd6dc5eed7fe897c2f9b88c9a5d6d.
Yes, a temporary workaround is available. Developers can manually add the missing of_node_put call after the of_find_compatible_node function. However, it is crucial to replace this workaround with the official fix as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
