Vulnerability in Kernel package: serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
Summary
GSD-2021-1000660: serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'. Affects Kernel versions < 35265552c7fe9553c75e324c80f45e28ff14eb6e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and processes. The serial driver in the Kernel package allows communication with serial devices. The 'rp2' module within the serial driver is responsible for handling firmware requests. This vulnerability specifically affects the 'rp2' module and its usage of the 'request_firmware_nowait' function.
Vulnerability Detail
The vulnerability arises from the use of the 'request_firmware_nowait' function in the 'rp2' module. This function is asynchronous and does not wait for the firmware to be loaded before returning control to the caller. As a result, there is a potential race condition where the firmware may not be available when needed, leading to unexpected behavior or system instability. Attackers could potentially exploit this vulnerability to disrupt serial communication or execute arbitrary code. The vulnerability has been addressed in Linux Kernel version v4.19.193 by replacing 'request_firmware_nowait' with the synchronous 'request_firmware' function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel package's 'rp2' module has the potential to disrupt serial communication and allow for arbitrary code execution. It is crucial to update the Linux Kernel package to version v4.19.193 or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could result in disrupted serial communication or potential execution of arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the Vulert Playground will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to promptly apply the recommended fix to mitigate any potential risks.
This vulnerability can potentially be exploited remotely if the affected system is exposed to untrusted network connections. It is crucial to update the Kernel package to the fixed version to prevent any remote exploitation.
There are no specific prerequisites mentioned for exploiting this vulnerability. However, an attacker would need to have the ability to trigger firmware requests in the 'rp2' module of the Kernel package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
