Vulnerability in Kernel package: video: fbdev: clcdfb
Summary
GSD-2022-1003747: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup. Affects Kernel versions >= d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 8db59df7f5826e104db82cfddbf22a33a151193e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services and interfaces for hardware interaction, including video display. The video: fbdev: clcdfb module within the Kernel package handles the framebuffer device for certain graphics hardware. It allows applications to write directly to the video memory, enabling graphical output on the screen. However, a vulnerability has been discovered in the clcdfb_of_vram_setup function, which can lead to a reference count leak.
Vulnerability Detail
The vulnerability in the clcdfb_of_vram_setup function of the video: fbdev: clcdfb module allows for a reference count leak. This can result in a resource leak, potentially leading to memory corruption or exhaustion. An attacker could potentially exploit this vulnerability to escalate privileges, execute arbitrary code, or cause a denial-of-service condition. The vulnerability was introduced in version v3.17 of the Linux Kernel and is fixed in version v5.4.198.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Kernel package.
Conclusion
The vulnerability in the video: fbdev: clcdfb module of the Kernel package can lead to memory corruption or exhaustion, potentially enabling privilege escalation, code execution, or denial-of-service attacks. It is crucial to update the Kernel package to version v5.4.198 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to memory corruption or exhaustion, allowing an attacker to escalate privileges, execute arbitrary code, or cause a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any known vulnerabilities.
Yes, a patch for this vulnerability is available in version v5.4.198 of the Linux Kernel. It is recommended to update to this version or a later one to fix the vulnerability.
Unfortunately, there is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Kernel package to a version that includes the patch.
You can find more information about this vulnerability in the GSD-2022-1003747 entry of the GSD Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003747.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
