Fix cxl_hdm_decode_init() calling convention in Kernel
Summary
GSD-2022-1005138: tools/testing/cxl: Fix cxl_hdm_decode_init() calling convention. Affects Kernel versions >= 92804edb11f065aadb3a4f398bed8a846a035cd3, < f1347e13865af216e91f574ac2388c27f3312554. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is an open-source software that serves as the core component of the Linux operating system. It provides essential functionality, such as managing system resources, facilitating communication between hardware and software, and enabling the execution of user programs. The vulnerability in question affects the Kernel's 'tools/testing/cxl' module, which is responsible for testing and debugging the Coherent Accelerator Interface Architecture (CAIA) driver. The cxl_hdm_decode_init() function within this module has an incorrect calling convention, potentially leading to security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the incorrect calling convention used in the cxl_hdm_decode_init() function of the 'tools/testing/cxl' module. This issue could potentially be exploited by malicious actors to execute arbitrary code or trigger a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.19.4 by commit f1347e13865af216e91f574ac2388c27f3312554. The vulnerability was introduced in version v5.19 by commit 92804edb11f065aadb3a4f398bed8a846a035cd3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the vulnerability in the cxl_hdm_decode_init() calling convention within the Kernel's 'tools/testing/cxl' module has the potential to be exploited for arbitrary code execution or denial-of-service attacks. It is crucial to update the Kernel to version v5.19.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could allow attackers to execute arbitrary code or cause a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to update the Kernel to the fixed version.
The fixed version of the Kernel can be obtained from the official Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/.
Yes, you can wait for your Linux distribution to release an updated package containing the fixed version of the Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
