net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
Summary
GSD-2022-1002975: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register. Affects Kernel versions >= a3c53be55c955b7150cda17874c3fcb4eeb97a89, < e0d763d0c7665c7897e4f5a0847ab0c82543345f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'mv88e6xxx' driver is a part of the Linux Kernel and is responsible for managing the Marvell 88E6xxx series of Ethernet switches. These switches are commonly used in network devices to provide multiple Ethernet ports. The 'mv88e6xxx_mdios_register' function in the driver is used to register the MDIO bus for communication with the switch. However, a refcount leak vulnerability has been identified in this function.
Vulnerability Detail
The refcount leak vulnerability in the 'mv88e6xxx_mdios_register' function can lead to a resource leak, potentially causing a denial-of-service condition. When the function is called multiple times, it fails to release the reference count on the MDIO bus, resulting in a memory leak. An attacker could exploit this vulnerability by repeatedly calling the function, exhausting system resources and causing the system to become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the Linux Kernel to the fixed version.
Conclusion
The 'mv88e6xxx' driver in the Linux Kernel is vulnerable to a refcount leak issue in the 'mv88e6xxx_mdios_register' function. This vulnerability can lead to a denial-of-service condition. To mitigate the risk, it is recommended to update the Linux Kernel to version v5.17.15 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service condition, potentially causing the affected system to become unresponsive.
An attacker can exploit this vulnerability by repeatedly calling the 'mv88e6xxx_mdios_register' function, exhausting system resources and causing a denial-of-service condition.
No, there is no known workaround for this vulnerability. Updating the Linux Kernel to the fixed version is necessary.
The vulnerability was introduced in version v4.11 and is present in all versions until v5.17.14. It is fixed in version v5.17.15 and later.
You can find more information about this vulnerability in the Open Source Vulnerability database with ID GSD-2022-1002975.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
