Vulnerability in Kernel: i2c: acpi: fix resource leak in reconfiguration device addition
Summary
GSD-2021-1001685: i2c: acpi: fix resource leak in reconfiguration device addition. Affects Kernel versions >= 525e6fabeae286848592363bda13bc34b59bb5ac, < 90f1077c9184ec2ae9989e4642f211263f301694. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The i2c subsystem in the Kernel is responsible for handling communication with I2C devices, which are commonly used for connecting various hardware components. The ACPI (Advanced Configuration and Power Interface) subsystem in the Kernel provides support for power management and device configuration. This vulnerability specifically affects the ACPI i2c driver, which is responsible for device addition during reconfiguration. The vulnerability can lead to a resource leak, potentially causing system instability or denial of service.
Vulnerability Detail
The vulnerability arises from a resource leak in the ACPI i2c driver during device addition in reconfiguration scenarios. When adding a new device, the driver fails to release certain resources, leading to a gradual depletion of resources over time. This can result in system instability, performance degradation, or even denial of service if the system exhausts critical resources. The vulnerability was introduced in Kernel version v4.8 and has been fixed in version v5.14.12. It is important to update to the fixed version to mitigate the risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the ACPI i2c driver if it is not essential for their system's functionality. This can be achieved by modifying the Kernel configuration and rebuilding it without the ACPI i2c driver. However, this workaround should be approached with caution, as it may impact the functionality of certain devices or features that rely on the ACPI i2c driver. It is recommended to consult the official documentation or seek expert guidance before applying this workaround.
Conclusion
The vulnerability in the Kernel's ACPI i2c driver can result in resource leaks and potential system instability or denial of service. It is important to update to the fixed version (v5.14.12 or later) or apply the recommended workaround. Regularly updating the Kernel and following security best practices are essential for maintaining a secure system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource depletion, system instability, performance degradation, or denial of service.
You can use tools like Vulert (https://vulert.com) to check if your system is affected. Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation. Simply upload your manifest file (e.g., package-lock.json) to the Vulert Playground (https://vulert.com/scanner) to check if your application is affected.
Yes, the vulnerability has been fixed in Kernel version v5.14.12. It is recommended to update to this version or a later one to mitigate the risk.
Yes, as a workaround, you can disable the ACPI i2c driver if it is not essential for your system's functionality. However, this may impact certain devices or features that rely on the driver. It is advisable to consult official documentation or seek expert guidance before applying this workaround.
To stay protected against vulnerabilities, it is crucial to regularly update the Kernel and apply security patches. Additionally, following best practices for system security, such as using firewalls, implementing access controls, and monitoring for security alerts, can help mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
