ARM: hisi: Add missing of_node_put after of_find_compatible_node
Summary
GSD-2022-1004061: ARM: hisi: Add missing of_node_put after of_find_compatible_node. Affects Kernel versions < 46cb7868811d025c3d29c10d18b3422db1cf20d5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ARM hisi package is a component of the Linux Kernel. It provides support for the HiSilicon ARM-based system-on-chips (SoCs). These SoCs are commonly used in various devices, including smartphones, tablets, and embedded systems. The package includes drivers and other necessary components to enable proper functioning of the HiSilicon SoCs on Linux-based systems.
Vulnerability Detail
The vulnerability in the ARM hisi package arises from a missing of_node_put function call after of_find_compatible_node. This missing call can lead to a reference count leak, potentially causing memory leaks and resource exhaustion. An attacker may be able to exploit this vulnerability to trigger a denial-of-service condition or potentially execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by updating the Linux Kernel to the patched version is the best course of action.
Conclusion
In conclusion, the ARM hisi package in the Linux Kernel is vulnerable to a missing of_node_put call after of_find_compatible_node. This can result in memory leaks, resource exhaustion, and potential privilege escalation. It is crucial to update the Linux Kernel to version v4.9.318 or later, which includes the necessary fix. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to memory leaks and resource exhaustion. It may also allow an attacker to trigger a denial-of-service condition or execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application or system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
There may be other vulnerabilities in the ARM hisi package that have not been discovered or reported yet. It is always recommended to keep your software and packages up to date to minimize the risk of any potential vulnerabilities.
You can find more information about this vulnerability, including the fix and its impact, in the Linux Kernel repository. The specific commit 46cb7868811d025c3d29c10d18b3422db1cf20d5 addresses this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
