Refcount Leak in fsl_rio_setup in Kernel
Summary
GSD-2022-1003896: powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup. Affects Kernel versions >= abc3aeae3aaa5c319d02f12649e17ea5929999aa, < 5b8aa2ba38c010f47c965dd9bb5a8561813ed649. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It acts as a bridge between the software and the underlying hardware. The fsl_rio_setup function in the powerpc/fsl_rio module is responsible for configuring the RapidIO subsystem on Freescale PowerPC platforms. RapidIO is a high-performance interconnect technology used in embedded systems. This vulnerability in fsl_rio_setup can lead to a refcount leak, which can cause resource exhaustion and potential system instability.
Vulnerability Detail
The vulnerability arises from a refcount leak in the fsl_rio_setup function. When this function is called, it fails to properly release the reference count on certain resources, leading to a leak. An attacker could potentially exploit this vulnerability to exhaust system resources, resulting in a denial-of-service condition or other forms of system instability. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v4.19.247.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to disable the fsl_rio module. This can be achieved by blacklisting the module or removing it from the system. However, it is important to note that this workaround may impact the functionality of the RapidIO subsystem on Freescale PowerPC platforms.
Conclusion
The refcount leak vulnerability in fsl_rio_setup in the Kernel can lead to resource exhaustion and potential system instability. It is crucial to update the Linux Kernel to version v4.19.247 or later to address this vulnerability. If immediate updating is not possible, disabling the fsl_rio module can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and potential system instability, potentially resulting in a denial-of-service condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in version v4.19.247 of the Linux Kernel. It is recommended to update to this version or a later one to ensure the vulnerability is patched.
If updating the Kernel is not immediately feasible, you can disable the fsl_rio module as a workaround. However, this may impact the functionality of the RapidIO subsystem on Freescale PowerPC platforms.
No, there are no known instances of this vulnerability being exploited at the moment. However, it is still important to apply the necessary updates and patches to ensure the system is protected.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
