Vulnerability in regulator: scmi package - refcount leak in scmi_regulator_probe
Summary
GSD-2022-1003373: regulator: scmi: Fix refcount leak in scmi_regulator_probe. Affects Kernel versions >= 0fbeae70ee7ce98e18a47337cd1f205dd88589e9, < 9ebbfa73d69909b7c737f599fd4ebd42318fc881. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The regulator: scmi package is a component of the Linux Kernel that provides support for System Control and Management Interface (SCMI) regulators. These regulators are responsible for managing power supply to various components in a system. The scmi_regulator_probe function is used to initialize and register SCMI regulators. However, a refcount leak vulnerability has been identified in this function, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The refcount leak vulnerability in scmi_regulator_probe arises due to improper handling of reference counts when initializing SCMI regulators. This can result in a refcount leak, where the reference count for a regulator is not properly decremented, leading to resource leaks and potential memory corruption. An attacker with local access to the system could exploit this vulnerability to exhaust system resources, potentially causing a denial-of-service condition or even arbitrary code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
In conclusion, the regulator: scmi package in the Linux Kernel is vulnerable to a refcount leak issue in the scmi_regulator_probe function. This vulnerability can lead to resource exhaustion and potential system instability. It is recommended to update the Linux Kernel to version v5.15.46 or later to fix this vulnerability. No known workarounds are available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to resource exhaustion and system instability. An attacker could exploit this vulnerability to cause a denial-of-service condition or execute arbitrary code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability was introduced in Linux Kernel version v5.11 by commit 0fbeae70ee7ce98e18a47337cd1f205dd88589e9. It is fixed in version v5.15.46 by commit 9ebbfa73d69909b7c737f599fd4ebd42318fc881.
There are no known exploits for this vulnerability at the time of this report. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2022-1003373. The link to the database entry is provided in the references section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
