Refcount Leak in mdp4_modeset_init_intf in drm/msm/mdp4
Summary
GSD-2022-1004267: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf. Affects Kernel versions >= 86418f90a4c1a0073db65d8a1e2bf94421117a60, < d607da76fd2b1cf1d377af9d9b7c6f8fecbb0e1d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/msm/mdp4 module is a part of the Linux Kernel and is responsible for managing the display subsystem on Qualcomm Snapdragon SoCs. It provides support for the MDP4 (Mobile Display Processor 4) hardware, which is commonly found in various mobile devices. The mdp4_modeset_init_intf function initializes the MDP4 interface and is a critical component for display functionality.
Vulnerability Detail
The vulnerability identified as GSD-2022-1004267 is a refcount leak in the mdp4_modeset_init_intf function in the drm/msm/mdp4 module. This issue was introduced in Linux Kernel version 4.12 by commit 86418f90a4c1a0073db65d8a1e2bf94421117a60 and was fixed in version 5.18.8 by commit d607da76fd2b1cf1d377af9d9b7c6f8fecbb0e1d. The vulnerability can be exploited to cause a refcount leak, potentially leading to resource exhaustion and denial of service. However, the actual impact and attack plausibility have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version 5.18.8 or later. This can be done by pulling the latest updates from the official Linux Kernel repository using the following command:
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Once the repository is cloned, navigate to the cloned directory and checkout the fixed commit:
$ git checkout d607da76fd2b1cf1d377af9d9b7c6f8fecbb0e1d
After checking out the fixed commit, compile and install the updated kernel following the standard procedures for your distribution.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the refcount leak vulnerability in mdp4_modeset_init_intf in drm/msm/mdp4 can potentially lead to resource exhaustion and denial of service. It is recommended to update the Linux Kernel to version 5.18.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to resource exhaustion and denial of service by causing a refcount leak. However, the actual impact and attack plausibility have not been proven yet.
The vulnerability was introduced in version 4.12 of the Linux Kernel and was fixed in version 5.18.8.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
You can find more information about the vulnerability in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The vulnerability ID is GSD-2022-1004267.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.