Double Free Vulnerability in drm/amd/pm Package
Summary
GSD-2022-1003997: drm/amd/pm: fix double free in si_parse_power_table(). Affects Kernel versions < 6c5bdaa1325be7f04b79ea992ab216739192d342. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/pm package is a component of the Linux Kernel that handles power management for AMD graphics cards. It provides functionality for parsing power tables and managing power states. This package is critical for proper functioning and performance of AMD graphics cards on Linux systems.
Vulnerability Detail
The si_parse_power_table() function in the drm/amd/pm package is vulnerable to a double free issue. This vulnerability could be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. The vulnerability arises from improper handling of memory deallocation, leading to a situation where the same memory is freed twice. An attacker could potentially trigger this vulnerability by sending specially crafted input to the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix mentioned above to ensure the security and stability of the system.
Conclusion
The double free vulnerability in the drm/amd/pm package of the Linux Kernel can have severe consequences, including denial-of-service and potential code execution. It is crucial to update the kernel to version v4.14.283 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to a denial-of-service condition or potential code execution with kernel privileges. An attacker could exploit this vulnerability to crash the system or gain unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is crucial to apply the recommended fix promptly to mitigate any potential risks.
The vulnerability is present in versions of the Linux Kernel prior to v4.14.283. It is recommended to update to this version or later to address the vulnerability.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
