extcon: Modify extcon device to be created after driver data is set
Summary
GSD-2022-1003667: extcon: Modify extcon device to be created after driver data is set. Affects Kernel versions < d472c78cc82999d07bd09193a6718016ce9cd386. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The extcon package is a component of the Linux Kernel that handles the management of external connectors. It provides a framework for detecting and handling changes in the state of external connections, such as USB or HDMI. The extcon device represents a physical connector and is associated with a driver that controls its behavior. This vulnerability in the extcon package allows the extcon device to be created before the driver data is set, potentially leading to incorrect behavior or crashes.
Vulnerability Detail
The vulnerability arises from the order in which the extcon device and driver data are created. When the extcon device is created before the driver data is set, the driver may not have access to the necessary information to properly handle the device. This can result in unexpected behavior, such as incorrect detection of connection state changes or crashes. An attacker could potentially exploit this vulnerability to manipulate the behavior of external connectors or cause denial-of-service conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The extcon package in the Linux Kernel is vulnerable to a flaw that allows the extcon device to be created before the driver data is set. This can result in incorrect behavior or crashes when handling external connectors. Users should update their Linux Kernel to version v5.4.198 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The extcon package is a component of the Linux Kernel that handles the management of external connectors, such as USB or HDMI.
An extcon device represents a physical connector and is associated with a driver that controls its behavior.
The vulnerability can lead to incorrect behavior or crashes when handling external connectors, potentially allowing attackers to manipulate their behavior or cause denial-of-service conditions.
To fix the vulnerability, users should update their Linux Kernel to version v5.4.198 or later.
There is no specific workaround mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
