Vulnerability in drm/msm/mdp5 Package: Return Error Code in mdp5_mixer_release when Deadlock is Detected
Summary
GSD-2022-1003628: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected. Affects Kernel versions >= 7907a0d77cb461f58045763c205a5830be72e97c, < 883f1d52a57bf51e1d7a80c432345e2c6222477e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/msm/mdp5 package is a component of the Linux Kernel that provides support for display controllers on Qualcomm Snapdragon SoCs. It includes the MDP5 (Multimedia Display Processor 5) driver, which is responsible for managing the display mixer hardware. The mdp5_mixer_release function is used to release resources associated with a display mixer. However, a vulnerability exists in this function that can lead to a deadlock condition.
Vulnerability Detail
The vulnerability in the drm/msm/mdp5 package occurs when the mdp5_mixer_release function is called. If a deadlock is detected during the release process, the function does not return an error code, potentially leaving the system in an inconsistent state. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The vulnerability in the drm/msm/mdp5 package can lead to a deadlock condition and potentially enable arbitrary code execution. It is crucial to update the Linux Kernel to version v5.10.121 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a deadlock condition, potentially causing a denial-of-service or enabling arbitrary code execution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
To exploit this vulnerability, an attacker would need to have the ability to execute code on the affected system.
While it is technically possible to manually patch the affected code, it is strongly recommended to update the Linux Kernel to the latest version instead. Manual patching can be error-prone and may introduce other issues.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
