Refcount Leak in rockchip_grf_init in Kernel
Summary
GSD-2022-1003859: soc: rockchip: Fix refcount leak in rockchip_grf_init. Affects Kernel versions >= 4c58063d4258f6beb4fd5647db6b58f49e337c8f, < 28133325526b92921f3269fdf97a20d90b92b217. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, including memory, processes, and device drivers. The rockchip_grf_init function is part of the rockchip system-on-chip (SoC) driver in the Kernel. It initializes the General Register Files (GRF) for Rockchip SoCs, which are responsible for configuring various hardware settings. This vulnerability in rockchip_grf_init can lead to a refcount leak, potentially causing resource exhaustion and system instability.
Vulnerability Detail
The vulnerability in rockchip_grf_init arises from a refcount leak. When the function is called multiple times without proper reference counting, it can result in a leak of system resources. An attacker could potentially exploit this vulnerability to exhaust system resources, leading to a denial-of-service (DoS) condition or other forms of system instability. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Linux Kernel version v4.11 by commit 4c58063d4258f6beb4fd5647db6b58f49e337c8f and is fixed in version v4.19.247 by commit 28133325526b92921f3269fdf97a20d90b92b217.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerable code path by ensuring that the rockchip_grf_init function is called with proper reference counting. This can be achieved by carefully managing the calling sequence and ensuring that the function is not invoked multiple times without appropriate reference counting.
Conclusion
The refcount leak vulnerability in rockchip_grf_init can potentially lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v4.19.247 or later to mitigate this vulnerability. Applying the fix will address the refcount leak and ensure the proper functioning of the rockchip system-on-chip driver. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to resource exhaustion and system instability, resulting in a denial-of-service (DoS) condition or other adverse effects.
An attacker could exploit this vulnerability by triggering the refcount leak in rockchip_grf_init, causing resource exhaustion and potentially destabilizing the system.
The vulnerability was introduced in Linux Kernel version v4.11 and affects all subsequent versions until v4.19.246. It is fixed in version v4.19.247 and later.
Yes, a patch is available in Linux Kernel version v4.19.247. Users are advised to update their Kernel to this version or later to mitigate the vulnerability.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the fix to ensure system security and stability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
