Vulnerability in pinctrl: ralink package - Null Return of devm_kcalloc
Summary
GSD-2022-1004545: pinctrl: ralink: Check for null return of devm_kcalloc. Affects Kernel versions >= a86854d0c599b3202307abceb68feee4d7061578, < 5694b162f275fb9a9f89422701b2b963be11e496. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pinctrl: ralink package is a component of the Linux Kernel that provides pin control and GPIO functionality for Ralink SoCs. It allows for the configuration and management of pins and GPIOs on Ralink-based devices. However, a vulnerability has been discovered in this package that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the pinctrl: ralink package involves a failure to check for a null return value of devm_kcalloc. This vulnerability was introduced in version v4.18 of the Linux Kernel by commit a86854d0c599b3202307abceb68feee4d7061578 and was fixed in version v5.10.134 by commit 5694b162f275fb9a9f89422701b2b963be11e496. The impact and attack plausibility of this vulnerability have not been proven yet. However, if exploited, it could potentially lead to security breaches and compromise the integrity and confidentiality of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually check for a null return value of devm_kcalloc and handle it appropriately in their code. Here is an example of how this can be done:
/* Check for null return value of devm_kcalloc */
ptr = devm_kcalloc(dev, num_elements, sizeof(element_type), GFP_KERNEL);
if (!ptr) {
/* Handle null return value */
return -ENOMEM;
}
Conclusion
In conclusion, the pinctrl: ralink package in the Linux Kernel is vulnerable to a null return value issue in devm_kcalloc. This vulnerability can potentially be exploited to compromise the security of the affected system. It is crucial to update the Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The pinctrl: ralink package is a component of the Linux Kernel that provides pin control and GPIO functionality for Ralink SoCs.
devm_kcalloc is a memory allocation function in the Linux Kernel that allocates and initializes memory for an array of elements.
This vulnerability was introduced in version v4.18 of the Linux Kernel by commit a86854d0c599b3202307abceb68feee4d7061578.
The impact of this vulnerability is not yet proven. However, if exploited, it could potentially lead to security breaches and compromise the integrity and confidentiality of the affected system.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.134 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
