Refcount Leak in clcdfb_of_vram_setup in Kernel
Summary
GSD-2022-1003993: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup. Affects Kernel versions >= d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 2e2e2c71b2642289438392edbf5d08cdbc0b138b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, including memory, processes, and input/output operations. The clcdfb driver is responsible for supporting framebuffer devices on various platforms. Framebuffer devices are used to display graphics on the screen. The clcdfb_of_vram_setup function in the clcdfb driver is vulnerable to a refcount leak, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The vulnerability in clcdfb_of_vram_setup arises from a refcount leak. When the function is called to set up video RAM (VRAM) for a framebuffer device, it fails to properly release the reference count on the VRAM object if an error occurs during initialization. This can result in a resource leak, where the VRAM object is not properly deallocated, leading to resource exhaustion over time. An attacker could potentially exploit this vulnerability to exhaust system resources, causing a denial-of-service condition or other system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by disabling the clcdfb driver. This can be achieved by blacklisting the clcdfb module. To do this, add the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist clcdfb
After adding the line, reboot the system to apply the changes. Disabling the clcdfb driver will prevent the vulnerable code from being executed, mitigating the risk of resource leaks.
Conclusion
The vulnerability in clcdfb_of_vram_setup can lead to resource leaks and potential system instability. It is crucial to update the Linux Kernel to the recommended version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The clcdfb driver is a component of the Linux Kernel that provides support for framebuffer devices on various platforms. Framebuffer devices are used to display graphics on the screen.
A refcount leak occurs when a reference count on a resource is not properly decremented, leading to a resource leak. In this case, the clcdfb_of_vram_setup function fails to release the reference count on the video RAM (VRAM) object, resulting in a resource leak.
The vulnerability can lead to resource exhaustion and potential system instability. An attacker could exploit this vulnerability to exhaust system resources, causing a denial-of-service condition or other system instability.
To fix this vulnerability, update the Linux Kernel to version v4.14.283 or later. The fix for this issue was implemented in commit 2e2e2c71b2642289438392edbf5d08cdbc0b138b.
Yes, a temporary workaround is to disable the clcdfb driver by blacklisting the clcdfb module. This can be done by adding the line 'blacklist clcdfb' to the /etc/modprobe.d/blacklist.conf file and rebooting the system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
