Vulnerability in coresight: cpu-debug Package
Summary
GSD-2022-1003973: coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier. Affects Kernel versions >= 2227b7c7463402ce92706a6f35c82cad6e8ee19a, < c2c7824b0bc6e42a4e702bc0b3dd61915e90b29f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coresight: cpu-debug package is a component of the Linux Kernel ecosystem. It provides functionality related to CPU debugging and is responsible for handling panic notifications. The package utilizes a mutex for synchronization purposes. However, a vulnerability has been discovered in the package that involves the use of a regular mutex instead of mutex_trylock on the panic notifier. This vulnerability was introduced in version v4.13 of the Linux Kernel by commit 2227b7c7463402ce92706a6f35c82cad6e8ee19a and has been fixed in version v4.14.283 by commit c2c7824b0bc6e42a4e702bc0b3dd61915e90b29f.
Vulnerability Detail
The vulnerability in the coresight: cpu-debug package arises from the incorrect usage of a mutex on the panic notifier. When a panic occurs, the mutex is acquired, which can lead to a deadlock situation if the panic notifier is already holding the mutex. This can result in a system crash or unresponsive behavior. An attacker may potentially exploit this vulnerability to cause a denial-of-service (DoS) attack or disrupt the normal functioning of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The coresight: cpu-debug package in the Linux Kernel is vulnerable to a mutex-related issue that can result in system crashes or unresponsive behavior. It is recommended to update to version v4.14.283 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to a system crash or unresponsive behavior, allowing an attacker to cause a denial-of-service (DoS) attack or disrupt the normal functioning of the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
Yes, the vulnerability has been fixed in version v4.14.283 of the Linux Kernel. It is recommended to update to this version or a later one to mitigate the vulnerability.
No, this vulnerability requires local access to the system in order to exploit it.
There are no known instances of this vulnerability being exploited in the wild.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
