Clocksource: Hyper-V: Unexport __init-annotated hv_init_clocksource()
Summary
GSD-2022-1004312: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource(). Affects Kernel versions >= dd2cb348613b44f9d948b068775e159aad298599, < 937fcbb55a1e48a6422e87e8f49422c92265f102. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Clocksource package is a component of the Linux Kernel that manages the system's clock sources. It provides a consistent timekeeping mechanism for various hardware platforms. The Clocksource package includes different clocksource drivers for specific hardware, including the Hyper-V clocksource driver for Microsoft Hyper-V virtualization environments.
Vulnerability Detail
The vulnerability in the Clocksource package affects the Hyper-V clocksource driver. Specifically, the __init-annotated hv_init_clocksource() function was unexported, which means it is not accessible to other parts of the kernel or external modules. This could lead to issues when initializing the Hyper-V clocksource, potentially resulting in timekeeping inaccuracies or other system instabilities. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Clocksource package in the Linux Kernel is vulnerable to an issue in the Hyper-V clocksource driver. Updating the kernel to version v5.18.6 or later is recommended to fix this vulnerability and ensure system stability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could include timekeeping inaccuracies or system instabilities in Hyper-V virtualization environments.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities, including this one.
No, the actual impact and attack plausibility of this vulnerability have not been proven yet. However, it is still recommended to update the Linux Kernel to the fixed version to ensure system stability.
The recommended mitigation is to update the Linux Kernel to version v5.18.6 or later, which includes the fix for this vulnerability.
You can find more information about this vulnerability in the GSD-2022-1004312 entry of the GSD Database. The source link is provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
