Vulnerability in Kernel package: serial: rp2
Summary
GSD-2021-1000709: serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'. Affects Kernel versions < 1e04d5d5fe5e76af68f834e1941fcbfa439653be. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services and interfaces for hardware communication, process management, and memory allocation. The 'serial: rp2' module within the Kernel package is specifically designed for handling serial communication on Raspberry Pi 2 devices. It allows the system to send and receive data through serial ports. However, a vulnerability has been discovered in this module, which could potentially lead to security breaches and unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in the 'serial: rp2' module arises from the improper usage of the 'request_firmware_nowait' function instead of the more secure 'request_firmware' function. This vulnerability could be exploited by malicious actors to execute arbitrary code or perform privilege escalation attacks. The issue was addressed in Linux Kernel version v4.4.271 by commit 1e04d5d5fe5e76af68f834e1941fcbfa439653be. It is crucial to update to this version or apply the corresponding patch to mitigate the vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the 'serial: rp2' module of the Kernel package poses a significant security risk, potentially allowing attackers to execute arbitrary code or escalate privileges. It is crucial to update the Kernel package to version v4.4.271 or later to mitigate this vulnerability. Alternatively, the provided patch can be applied. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could allow attackers to execute arbitrary code or perform privilege escalation attacks, potentially leading to unauthorized access to sensitive information or control over the affected system.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network. Attackers can target the vulnerable 'serial: rp2' module to gain unauthorized access or execute malicious code.
The vulnerability was introduced in an unknown version of the Kernel package and exists until version v4.4.270. It was fixed in version v4.4.271, so any version equal to or later than v4.4.271 is not affected.
No, there is no known workaround for this vulnerability. It is recommended to update the Kernel package to the fixed version or apply the provided patch.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
