Vulnerability in Kernel: Possible Memory Leak in mdp5_crtc_cursor_set()
Summary
GSD-2022-1003592: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set(). Affects Kernel versions >= e172d10a9c4acc69bb07cbe9142ded2df791ff1f, < 656aa3c51fc662064f17179b38ec3ce43af53bca. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in question affects the Kernel's msm (Mobile Station Modem) driver, specifically the mdp5_crtc_cursor_set() function. This function is responsible for setting the cursor image on the display controller of Qualcomm Adreno GPUs. The vulnerability could potentially lead to a memory leak, which can result in degraded system performance and resource exhaustion over time.
Vulnerability Detail
The vulnerability arises from a possible memory leak in the mdp5_crtc_cursor_set() function of the msm driver in the Kernel. When this function is called to set the cursor image, there is a chance that memory allocated for the cursor data is not properly freed, leading to a memory leak. Although the impact and attack plausibility have not been proven, a memory leak can gradually consume system resources, potentially causing system instability or denial of service. The vulnerability was introduced in Kernel version v4.0 and has been fixed in version v5.10.121 by commit 656aa3c51fc662064f17179b38ec3ce43af53bca.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the use of cursor images in the display controller configuration. This can be achieved by modifying the relevant configuration files or settings specific to the display controller driver. However, this workaround may result in the loss of cursor functionality.
Conclusion
In conclusion, the vulnerability in the Kernel's msm driver, specifically in the mdp5_crtc_cursor_set() function, could potentially lead to a memory leak. It is recommended to update the Kernel to version v5.10.121 or later to mitigate this vulnerability. Alternatively, users can apply the provided workaround of disabling cursor images in the display controller configuration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to a memory leak, which can gradually consume system resources and result in degraded performance or resource exhaustion. However, the actual impact and attack plausibility have not been proven.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply upload your manifest file (e.g., package-lock.json) to the playground and it will analyze the dependencies for potential vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate potential risks.
Yes, you can apply the provided workaround of disabling cursor images in the display controller configuration. However, keep in mind that this may result in the loss of cursor functionality.
You can refer to the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) for more details about the fix. The vulnerability details can be found in the GSD-2022-1003592.json file in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003592.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
