Vulnerability in spi-fsl-qspi package: check return value after calling platform_get_resource_byname()
Summary
GSD-2022-1003109: spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname(). Affects Kernel versions >= 858e26a515c28df3ef542d9c09493b54a329d6cf, < 33dda87d04598ac5d9a849218a373443f7d3de66. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi-fsl-qspi package is a component of the Linux Kernel, specifically designed for Freescale QSPI controllers. It provides support for SPI (Serial Peripheral Interface) flash memory devices. The package allows communication between the controller and the flash memory, enabling read and write operations. However, a vulnerability has been discovered in the package that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in spi-fsl-qspi arises from a failure to check the return value after calling platform_get_resource_byname(). This oversight can result in various security risks, although the exact impact and plausibility of an attack have not been proven. The vulnerability was introduced in version v5.8 of the Linux Kernel by commit 858e26a515c28df3ef542d9c09493b54a329d6cf and has been fixed in version v5.17.14 by commit 33dda87d04598ac5d9a849218a373443f7d3de66. For more detailed information, please refer to the provided references.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the spi-fsl-qspi package in the Linux Kernel is vulnerable to a security issue that can be mitigated by updating to version v5.17.14 or later. It is crucial to promptly apply the fix to ensure the secure operation of the package. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
spi-fsl-qspi is a package in the Linux Kernel that provides support for Freescale QSPI controllers, enabling communication with SPI flash memory devices.
The impact of this vulnerability is not yet proven, but it has the potential to lead to security issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes your manifest file, such as package-lock.json, and alerts you in real-time for any open-source vulnerabilities.
No specific workaround has been mentioned for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
You can find more information about this vulnerability in the provided references and the Vulert database (https://vulert.com).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
