Vulnerability in Kernel: phy: qcom-qmp: fix struct clk leak on probe errors
Summary
GSD-2022-1003983: phy: qcom-qmp: fix struct clk leak on probe errors. Affects Kernel versions >= e78f3d15e115e8e764d4b1562b4fa538f2e22f6b, < b999d48b0869b8599de532ff6081575a7ab5358a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The phy: qcom-qmp module within the Kernel is responsible for managing the Qualcomm QMP (Qualcomm Message Passing) PHY (Physical Layer) subsystem. This subsystem handles communication between the processor and various peripheral devices. However, a vulnerability has been identified in the phy: qcom-qmp module that can lead to a struct clk (clock) leak when probe errors occur during initialization.
Vulnerability Detail
The vulnerability in the phy: qcom-qmp module arises from a failure to release the struct clk resource in certain error scenarios during the initialization process. This can result in a resource leak, leading to potential memory corruption or system instability. An attacker with local access to the affected system may be able to exploit this vulnerability to escalate privileges or cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version v4.12 and has been fixed in version v4.14.283 by commit b999d48b0869b8599de532ff6081575a7ab5358a.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to apply the fix by updating the Linux Kernel to a patched version.
Conclusion
The vulnerability in the phy: qcom-qmp module of the Kernel can lead to memory corruption or system instability. It is crucial to update the Linux Kernel to version v4.14.283 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to memory corruption or system instability, allowing an attacker to escalate privileges or cause a denial-of-service condition.
You can use Vulert's playground at Vulert Scanner to check if your application or system is affected by this vulnerability. Vulert analyzes the manifest file, such as package-lock.json, to identify and alert in real-time for open-source vulnerabilities.
No, this vulnerability requires local access to the affected system to exploit it.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
If updating to the recommended Kernel version is not feasible, it is advisable to consult with your Linux distribution's support channels or seek assistance from a qualified system administrator to explore alternative mitigation options.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
