Vulnerability in pinctrl: ralink package - Null Return of devm_kcalloc
Summary
GSD-2022-1004687: pinctrl: ralink: Check for null return of devm_kcalloc. Affects Kernel versions >= a86854d0c599b3202307abceb68feee4d7061578, < 6194c021496addc11763d1ffa89ce5751889fe3c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pinctrl: ralink package is a component of the Linux Kernel that provides pin control and GPIO (General Purpose Input/Output) functionality for Ralink SoCs (System on Chips). It allows for the configuration and management of pins and GPIOs on Ralink-based devices. This package is widely used in various embedded systems and devices that utilize Ralink SoCs.
Vulnerability Detail
The vulnerability in the pinctrl: ralink package involves a failure to check for a null return value of the devm_kcalloc function. This vulnerability was introduced in version v4.18 of the Linux Kernel by commit a86854d0c599b3202307abceb68feee4d7061578 and was fixed in version v5.4.208 by commit 6194c021496addc11763d1ffa89ce5751889fe3c. The impact and attack plausibility of this vulnerability have not been proven yet. However, if an attacker can trigger the null return value of devm_kcalloc, it could potentially lead to a NULL pointer dereference and result in a system crash or other unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the pinctrl: ralink package in the Linux Kernel is vulnerable to a null return value issue in the devm_kcalloc function. This vulnerability can potentially lead to a system crash or other unexpected behavior. It is recommended to update the Linux Kernel to version v5.4.208 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The pinctrl: ralink package is a component of the Linux Kernel that provides pin control and GPIO functionality for Ralink SoCs.
devm_kcalloc is a function in the Linux Kernel that allocates memory for an array of objects and associates it with a device managed by the device model framework.
The specific exploitation vectors for this vulnerability have not been identified yet. However, if an attacker can trigger the null return value of devm_kcalloc, it could potentially lead to a NULL pointer dereference and result in a system crash or other unexpected behavior.
Yes, the vulnerability has been fixed in Linux Kernel version v5.4.208. It is recommended to update to this version or later to mitigate the risk.
You can find more information about this vulnerability in the GSD-2022-1004687 JSON file available on the GSD Database GitHub repository: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1004xxx/GSD-2022-1004687.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
