ARM: versatile: Missing of_node_put in dcscb_init
Summary
GSD-2022-1002731: ARM: versatile: Add missing of_node_put in dcscb_init. Affects Kernel versions < d6de7b181c29cd4578ec139aafb5eac062abbe1b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ARM versatile package is a versatile platform used for developing and testing ARM-based systems. It provides a range of features and components for system emulation and development. One of these components is dcscb_init, which initializes the Device Configuration Space Control Block (DCSCB) for the versatile platform. The DCSCB is responsible for managing the configuration and control of devices connected to the platform. However, there is a vulnerability in the dcscb_init function that leads to a missing of_node_put, potentially causing a resource leak and other security issues.
Vulnerability Detail
The vulnerability in the dcscb_init function of the ARM versatile package arises from the missing of_node_put. This omission can result in a resource leak, where the reference count of the device tree node is not properly decremented, leading to potential memory leaks and other security issues. An attacker may be able to exploit this vulnerability to exhaust system resources, cause a denial of service, or potentially execute arbitrary code. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the ARM versatile package is vulnerable to a missing of_node_put in the dcscb_init function, which can lead to resource leaks and other security issues. It is recommended to update to Linux Kernel version v5.18.3 or a later version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ARM versatile package is a versatile platform used for developing and testing ARM-based systems. It provides a range of features and components for system emulation and development.
The dcscb_init function in the ARM versatile package is responsible for initializing the Device Configuration Space Control Block (DCSCB) for the versatile platform. The DCSCB manages the configuration and control of devices connected to the platform.
The missing of_node_put in dcscb_init can lead to a resource leak, potentially causing memory leaks and other security issues. An attacker may be able to exploit this vulnerability to exhaust system resources, cause a denial of service, or potentially execute arbitrary code.
No, the impact and attack plausibility of this vulnerability have not been proven. This vulnerability is an automated ID intended to aid in the discovery of potential security vulnerabilities.
To fix this vulnerability, it is recommended to update to Linux Kernel version v5.18.3 or a later version, which includes the fix for this vulnerability. The fix involves adding the missing of_node_put in the dcscb_init function.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
