Vulnerability in Kernel package: sparcspkr - refcount leak in bbc_beep_probe
Summary
GSD-2022-1003898: Input: sparcspkr - fix refcount leak in bbc_beep_probe. Affects Kernel versions >= 9c1a5077fdca99356c891af37931e537dea874f5, < 353bc58ac6c782d4dcde9136a91d1f90867938fe. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The sparcspkr module within the Kernel package handles the system speaker on SPARC-based systems, enabling audio feedback for various events. However, a vulnerability has been discovered in the bbc_beep_probe function of the sparcspkr module, leading to a refcount leak.
Vulnerability Detail
The vulnerability in the bbc_beep_probe function of the sparcspkr module results in a refcount leak. This leak can potentially cause memory exhaustion and impact system stability. An attacker may be able to exploit this vulnerability to trigger a denial-of-service condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in version v2.6.26 of the Linux Kernel and has been fixed in version v4.19.247.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the recommended fix by updating the Linux Kernel package.
Conclusion
The vulnerability in the Kernel package's sparcspkr module, specifically in the bbc_beep_probe function, can lead to memory exhaustion, system instability, and potential code execution or denial-of-service attacks. To mitigate these risks, it is crucial to update the Linux Kernel package to version v4.19.247 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory exhaustion and system instability. It may also allow attackers to execute arbitrary code with elevated privileges or trigger a denial-of-service condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the recommended fix to mitigate any potential risks.
The vulnerability itself does not provide remote exploitation capabilities. However, if an attacker gains access to the system, they can potentially exploit the vulnerability to execute arbitrary code or trigger a denial-of-service condition.
In addition to updating the Linux Kernel package, it is recommended to follow security best practices such as regularly applying security patches, implementing strong access controls, and monitoring system logs for any suspicious activities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
