Refcount Leak in cleanup_dev() in char: xillybus
Summary
GSD-2022-1003213: char: xillybus: fix a refcount leak in cleanup_dev(). Affects Kernel versions < bc8fceda3b89006e8a7dda8a097d36045d044c25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The char: xillybus package is a component of the Linux Kernel, which is responsible for managing communication between user space and FPGA devices. It provides a character device interface for FPGA-based devices, allowing users to read from and write to these devices. The cleanup_dev() function is a part of this package and is responsible for cleaning up resources associated with a device when it is no longer needed.
Vulnerability Detail
The vulnerability in the cleanup_dev() function of char: xillybus is a refcount leak. When a device is being cleaned up, the function fails to properly release a reference count, leading to a resource leak. This can result in memory leaks and other resource-related issues. An attacker may be able to exploit this vulnerability to exhaust system resources, leading to a denial of service condition or potentially escalating their privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are strongly encouraged to apply the fix by updating their Linux Kernel.
Conclusion
In conclusion, the refcount leak vulnerability in the cleanup_dev() function of char: xillybus can lead to resource leaks and potential system resource exhaustion or privilege escalation. Users are advised to update their Linux Kernel to version v5.15.47 or later to apply the fix. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource leaks, including memory leaks, and potentially allow attackers to exhaust system resources or escalate their privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
If you are unable to update your Linux Kernel immediately, it is recommended to monitor your system for any signs of resource exhaustion or unusual behavior. Implementing additional security measures, such as strict access controls and network segmentation, can also help mitigate the risk.
You can find more information about this vulnerability in the Linux Kernel's Git repository. The specific commit that fixes this issue is bc8fceda3b89006e8a7dda8a097d36045d044c25.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
