Fix the wrong asm constraint in delay_loop() in Kernel

Kernel Updated 02 Oct 2025

Summary

28/06/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1004022: x86/delay: Fix the wrong asm constraint in delay_loop(). Affects Kernel versions >= e01b70ef3eb3080fecc35e15f68cd274c0a48163, < 0f1dd7632eab5a5433ea6c8de91778dd966b3a95. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. One of the critical aspects of the Kernel is its ability to handle delays efficiently. However, a vulnerability has been discovered in the delay_loop() function of the x86 architecture, which can lead to incorrect behavior and potential security risks.

Vulnerability Detail

The vulnerability arises from a wrong assembly constraint in the delay_loop() function of the x86 architecture. This issue was introduced in version v2.6.27 of the Linux Kernel and was fixed in version v4.14.283. The incorrect constraint can result in unexpected delays or incorrect timing calculations, potentially leading to performance issues or even security vulnerabilities. Attackers may be able to exploit this vulnerability to manipulate timing-sensitive operations or launch timing-based attacks.

How To Fix

No fixed version is published for this vulnerability.

To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.283 or later. This fix corrects the wrong asm constraint in the delay_loop() function, ensuring accurate timing calculations and preventing potential security risks.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a workaround, developers can manually modify the affected code in the delay_loop() function to fix the wrong asm constraint. Here is an example of the modified code:

void delay_loop(unsigned long loops)
{
  asm volatile(
    "1: decq %0\n\t"
    "jne 1b"
    : "=r" (loops)
    : "0" (loops)
    : "memory"
  );
}

Conclusion

In conclusion, the Kernel's delay_loop() function in the x86 architecture has a vulnerability due to a wrong asm constraint. This issue can lead to incorrect timing calculations and potential security risks. It is crucial to update the Linux Kernel to version v4.14.283 or later to fix this vulnerability. Developers can also manually modify the affected code using the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ

What is the impact of this vulnerability?

The vulnerability can result in incorrect timing calculations and potential security risks. Attackers may exploit this issue to manipulate timing-sensitive operations or launch timing-based attacks.

How can I check if my system is affected by this vulnerability?

You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.

You can find more information about this vulnerability, including the specific commits that introduced and fixed it, in the vulnerability details provided by the Cloud Security Alliance's GSD database. The details can be accessed at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1004xxx/GSD-2022-1004022.json.