Vulnerability in Kernel: net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
Summary
GSD-2022-1002595: net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list. Affects Kernel versions >= 14fceff4771e51b23b4485b575cf9e5b3414b89b, < 2e007ac6fa7c9c94ad84da075c5c504afad690a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It is responsible for managing system resources, including memory, processes, and input/output operations. The lantiq_gswip module in the Kernel is used for managing Ethernet switches on Lantiq SoCs. This vulnerability affects the gswip_gphy_fw_list function in the lantiq_gswip module, which is responsible for handling firmware loading for the Ethernet PHYs connected to the switch. The vulnerability can lead to a refcount leak, potentially causing resource exhaustion and other security issues.
Vulnerability Detail
The vulnerability in the gswip_gphy_fw_list function of the lantiq_gswip module allows for a refcount leak. This can be exploited by an attacker to exhaust system resources, leading to denial-of-service conditions or other security issues. The refcount leak occurs when the function fails to properly release resources after handling firmware loading for the Ethernet PHYs. This can result in an accumulation of unreleased resources, potentially causing memory leaks and other resource-related problems. The vulnerability was introduced in version v4.20 of the Linux Kernel and has been fixed in version v5.18.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the Linux Kernel.
Conclusion
The vulnerability in the lantiq_gswip module of the Kernel can lead to resource exhaustion and other security issues. It is recommended to update the Linux Kernel to version v5.18.4 or later to mitigate this vulnerability. Users can also use the Vulert Playground to check if their system is affected and take appropriate actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource exhaustion and other security issues. It may allow an attacker to cause denial-of-service conditions or potentially exploit other vulnerabilities in the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any known vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches and updates as soon as they become available.
The exact exploitability of this vulnerability depends on various factors, including system configuration and network setup. However, in general, remote exploitation is possible if the affected system is accessible over the network and the necessary conditions are met.
For more details about this vulnerability, including the specific code changes that fix it, you can refer to the vulnerability report on the Cloud Security Alliance GSD Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002595.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
