Vulnerability in powerpc/iommu Package: Missing of_node_put in iommu_init_early_dart
Summary
GSD-2022-1003746: powerpc/iommu: Add missing of_node_put in iommu_init_early_dart. Affects Kernel versions < cb4f2dc513e99c5d0485661f114e4dda73612d10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The powerpc/iommu package is a component of the Linux Kernel, which is responsible for managing input/output memory management units (IOMMUs) on PowerPC architecture systems. IOMMUs provide memory address translation and access control for devices connected to the system. The iommu_init_early_dart function initializes the IOMMU subsystem during early system boot. However, a missing of_node_put call in this function can lead to a resource leak.
Vulnerability Detail
The vulnerability arises from the omission of an of_node_put call in the iommu_init_early_dart function. This can result in a resource leak, potentially leading to memory exhaustion or other resource-related issues. An attacker with local access to the system may be able to exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk.
Conclusion
The powerpc/iommu package in the Linux Kernel is vulnerable to a resource leak due to a missing of_node_put call in the iommu_init_early_dart function. This vulnerability can potentially lead to memory exhaustion or other resource-related issues. It is crucial to update the Linux Kernel to version v5.4.198 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a resource leak, potentially leading to memory exhaustion or other resource-related issues. It may allow an attacker with local access to the system to cause a denial-of-service condition or execute arbitrary code with elevated privileges.
You can check the version of the Linux Kernel installed on your system. If it is earlier than v5.4.198, your system is likely vulnerable. Additionally, you can use vulnerability monitoring tools like Vulert to scan your system and identify any potential vulnerabilities.
No, this vulnerability requires local access to the system to be exploited.
There are no known instances of this vulnerability being exploited in the wild.
You can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003746.json for more details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
