Vulnerability in Kernel package: usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
Summary
GSD-2021-1001699: usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle. Affects Kernel versions >= 746f316b753a83e366bfc5f936cbf0d72d1c2d1d, < 66dd03b10e1c0b2fae006c6e34c18ea8ee033e7b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The usb: chipidea: ci_hdrc_imx module within the Kernel package is specifically designed for USB functionality on i.MX platforms. It enables USB host and gadget support for these platforms, allowing for USB communication with external devices. However, a vulnerability has been identified in this module that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the usb: chipidea: ci_hdrc_imx module arises from a failure to properly search for 'phys' phandle. This oversight could be exploited by malicious actors to execute arbitrary code or trigger a denial-of-service attack. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.14.12 by commit 66dd03b10e1c0b2fae006c6e34c18ea8ee033e7b. However, it was introduced in version v5.8 by commit 746f316b753a83e366bfc5f936cbf0d72d1c2d1d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Kernel package's usb: chipidea: ci_hdrc_imx module is vulnerable to a security issue related to the search for 'phys' phandle. It is crucial to update the Kernel package to version v5.14.12 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow attackers to execute arbitrary code or trigger a denial-of-service attack.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your manifest file, such as package-lock.json, without requiring access to the code or installation.
Yes, the vulnerability has been fixed in Linux Kernel version v5.14.12 by commit 66dd03b10e1c0b2fae006c6e34c18ea8ee033e7b.
Yes, you can apply the specific commit 66dd03b10e1c0b2fae006c6e34c18ea8ee033e7b to older versions of the Kernel package to address this vulnerability.
You can refer to the vulnerability details in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001699.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
