Vulnerability in Kernel Package: efi/fdt
Summary
GSD-2021-1000762: efi/fdt: fix panic when no valid fdt found. Affects Kernel versions >= b91540d52a08b65eb6a2b09132e1bd54fa82754c, < 5148066edbdc89c6fe5bc419c31a5c22e5f83bdb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as device drivers, memory management, and process scheduling. The efi/fdt module within the Kernel package handles the parsing and processing of device tree blobs (DTBs) in the Extensible Firmware Interface (EFI) environment. DTBs contain information about the hardware devices present in the system. This vulnerability affects the efi/fdt module when it fails to find a valid DTB, leading to a panic condition.
Vulnerability Detail
The vulnerability arises when the efi/fdt module encounters a situation where no valid DTB is found. This can occur due to various reasons, such as a missing or corrupted DTB file. When this happens, the module panics, resulting in a system crash. An attacker could potentially exploit this vulnerability by deliberately manipulating the DTB file or causing its absence, leading to a denial-of-service (DoS) scenario. It is important to note that the impact and attack feasibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can ensure the presence of a valid DTB file before booting the system. This can be achieved by verifying the integrity of the DTB file or restoring it from a known good backup. Additionally, users can consider disabling the efi/fdt module if it is not required for their specific system configuration. However, disabling the module may impact the functionality of certain EFI-based systems.
Conclusion
In conclusion, the efi/fdt module in the Kernel package is vulnerable to a panic condition when no valid DTB is found. This vulnerability can potentially be exploited to cause a system crash. It is recommended to update the Kernel package to the latest version to mitigate this issue. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing core system functions.
The efi/fdt module is a part of the Kernel package that handles the parsing and processing of device tree blobs (DTBs) in the EFI environment.
A DTB (device tree blob) is a binary file that contains information about the hardware devices present in a system.
The vulnerability can lead to a system crash (panic) when the efi/fdt module fails to find a valid DTB, potentially resulting in a denial-of-service (DoS) scenario.
Updating the Linux Kernel package to version v5.10.43 or later will address this vulnerability. Ensure that you apply the necessary updates provided by your distribution or vendor.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
