Vulnerability in drm/tegra package: Do not leak runtime PM reference
Summary
GSD-2021-1001049: drm/tegra: sor: Do not leak runtime PM reference. Affects Kernel versions < 6fc59edf0471eacba5769a83683f3f13834d1166. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/tegra package is a component of the Linux Kernel ecosystem. It provides support for the Tegra display controller and related functionalities. The package is responsible for managing the display output on Tegra-based devices. It includes drivers and modules that enable the interaction between the hardware and the operating system's display subsystem. The vulnerability in this package involves a runtime PM reference leak, which can potentially lead to resource exhaustion and system instability.
Vulnerability Detail
The vulnerability in the drm/tegra package involves a runtime PM reference leak. Runtime PM (Power Management) is a mechanism used to manage the power state of devices in the system. When a device is not in use, it can be put into a low-power state to conserve energy. However, if a runtime PM reference is leaked, the device may not be properly powered down when it is no longer needed, leading to resource exhaustion and potential system instability. This vulnerability can be exploited by an attacker to cause denial-of-service conditions or to gain elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Linux Kernel to the fixed version.
Conclusion
The vulnerability in the drm/tegra package involves a runtime PM reference leak, which can lead to resource exhaustion and potential system instability. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.12.12 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource exhaustion and potential system instability. It can be exploited by an attacker to cause denial-of-service conditions or to gain elevated privileges.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
There is no known exploit for this vulnerability at the moment. However, it is important to apply the recommended fix to mitigate the risk.
The vulnerability specifically affects the drm/tegra package in the Linux Kernel. There may be other packages or dependencies indirectly affected, depending on their reliance on the drm/tegra package.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001049.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
