Refcount Leak in PM / devfreq: exynos-ppmu
Summary
GSD-2022-1004441: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events. Affects Kernel versions >= f262f28c147051e7aa6daaf4fb5996833ffadff4, < 01121e39ef537289926ae6f5374dce92c796d863. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PM / devfreq package is responsible for managing the frequency scaling of devices in the Linux kernel. It provides a framework for controlling the frequency of various hardware components to optimize power consumption. The exynos-ppmu driver is a specific implementation for Exynos-based SoCs. It utilizes the Performance Monitoring Unit (PPMU) to monitor and control the frequency of the device. However, a refcount leak vulnerability has been identified in the of_get_devfreq_events function of the exynos-ppmu driver.
Vulnerability Detail
The vulnerability arises due to a refcount leak in the of_get_devfreq_events function of the exynos-ppmu driver. This leak can lead to a resource exhaustion condition, potentially resulting in a denial of service (DoS) scenario. An attacker could exploit this vulnerability by repeatedly triggering the function, causing the refcount to increment and eventually exhaust system resources. The impact of this vulnerability can vary depending on the specific use case and system configuration. It is important to note that the attack plausibility and actual impact have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The refcount leak vulnerability in the PM / devfreq exynos-ppmu driver can potentially lead to a denial of service (DoS) scenario. It is crucial to update the Linux Kernel to version v5.15.53 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The PM / devfreq package is responsible for managing the frequency scaling of devices in the Linux kernel. It provides a framework for controlling the frequency of various hardware components to optimize power consumption.
The exynos-ppmu driver is a specific implementation for Exynos-based SoCs. It utilizes the Performance Monitoring Unit (PPMU) to monitor and control the frequency of the device.
A refcount leak vulnerability occurs when a reference count for a resource is not properly decremented, leading to a resource exhaustion condition. In this case, the refcount leak in the of_get_devfreq_events function can result in a denial of service (DoS) scenario.
The impact of this vulnerability can vary depending on the specific use case and system configuration. It could potentially lead to a denial of service (DoS) scenario if system resources are exhausted. However, the attack plausibility and actual impact have not been proven.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.53 or later. This can be done by fetching the latest kernel source code from the official Linux Kernel repository and compiling it for the target system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
