Memory Leak in EFCH MMIO Support in i2c: piix4
Summary
GSD-2022-1004421: i2c: piix4: Fix a memory leak in the EFCH MMIO support. Affects Kernel versions >= 4b965566ca26e83553d92b8c57050e5d59911806, < d2bf1a6480e8d44658a8ac3bdcec081238873212. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The i2c: piix4 is a driver in the Linux Kernel that provides support for the I2C bus on the PIIX4 chipset. The PIIX4 chipset is commonly used in Intel-based systems and provides various functionalities, including I/O and power management. The EFCH (Enhanced Function Configuration Handling) MMIO (Memory-Mapped I/O) support is a feature of the i2c: piix4 driver that allows accessing configuration registers through memory-mapped I/O. This feature is vulnerable to a memory leak issue.
Vulnerability Detail
The memory leak vulnerability in the EFCH MMIO support of the i2c: piix4 driver allows an attacker to cause a continuous allocation of memory without proper deallocation, leading to memory exhaustion. By repeatedly triggering the vulnerable code path, an attacker can consume all available memory resources, potentially causing a denial-of-service (DoS) condition. The vulnerability was introduced in Linux Kernel version v5.15.42 and has been fixed in version v5.15.54.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The memory leak vulnerability in the EFCH MMIO support of the i2c: piix4 driver can be mitigated by updating the Linux Kernel to version v5.15.54 or later. This update includes the necessary fix to prevent memory exhaustion. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory exhaustion, potentially causing a denial-of-service (DoS) condition.
An attacker can repeatedly trigger the vulnerable code path to allocate memory without proper deallocation, consuming all available memory resources.
The vulnerability was introduced in Linux Kernel version v5.15.42 and fixed in version v5.15.54.
No specific workaround has been provided. It is recommended to update the Linux Kernel to the fixed version.
You can find more information about this vulnerability in the GSD-2022-1004421 JSON report provided by the Cloud Security Alliance's GSD database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
