extcon: Modify extcon device to be created after driver data is set
Summary
GSD-2022-1003939: extcon: Modify extcon device to be created after driver data is set. Affects Kernel versions < 6e721f3ad0535b24f19a62420f4da95212cf069c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The extcon package is a part of the Linux Kernel ecosystem. It provides support for handling external connectors and their associated events. The extcon device represents a physical connector and is used to monitor the state changes of the connector. The extcon driver data contains information specific to the connector and is associated with the extcon device. However, in versions prior to v4.14.283 of the Linux Kernel, the extcon device was created before the driver data was set, which could lead to potential vulnerabilities.
Vulnerability Detail
The vulnerability arises from the incorrect order of creating the extcon device and setting the driver data. This could potentially result in the extcon device being created without the necessary driver data, leading to unexpected behavior or security issues. The impact and attack plausibility of this vulnerability have not been proven yet. It is fixed in Linux Kernel version v4.14.283 by commit 6e721f3ad0535b24f19a62420f4da95212cf069c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The extcon vulnerability, which involves the creation of the extcon device before setting the driver data, has been identified and fixed in Linux Kernel version v4.14.283. It is recommended to update the kernel to the fixed version to mitigate any potential security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
extcon is a package in the Linux Kernel ecosystem that handles external connectors and their associated events.
The extcon device represents a physical connector and is used to monitor the state changes of the connector.
The extcon driver data contains information specific to the connector and is associated with the extcon device.
The impact of this vulnerability is not yet proven, but it could result in unexpected behavior or security issues.
To fix this vulnerability, update the Linux Kernel to version v4.14.283 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
