Vulnerability in powerpc/smp Package: CPU Offline Preempt Count Decrement
Summary
GSD-2021-1001889: powerpc/smp: do not decrement idle task preempt count in CPU offline. Affects Kernel versions >= 2c669ef6979c370f98d4b876e54f19613c81e075, < 3ea0b497a7a2fff6a4b7090310c9f52c91975934. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The powerpc/smp package is a component of the Linux Kernel, which is responsible for managing symmetric multiprocessing (SMP) on PowerPC architectures. It enables the utilization of multiple processors or cores in a system, improving performance and efficiency. The package includes functionality for CPU management, task scheduling, and synchronization in a multi-core environment. However, a vulnerability has been identified in the package that involves the incorrect decrementing of the idle task preempt count during CPU offline operations.
Vulnerability Detail
The vulnerability arises from a flaw in the powerpc/smp package, specifically in the handling of CPU offline operations. When a CPU is taken offline, the idle task preempt count is erroneously decremented, potentially leading to a race condition. This race condition could result in unexpected behavior or system instability, as the idle task preempt count is a critical component of the CPU scheduling mechanism. An attacker with local access to the affected system could potentially exploit this vulnerability to disrupt system operations or gain elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the powerpc/smp package, related to the incorrect decrementing of the idle task preempt count during CPU offline operations, poses a potential risk to system stability and security. It is recommended to update the Linux Kernel to version v5.14.15 or later to mitigate this vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially lead to system instability or unexpected behavior, as the incorrect decrementing of the idle task preempt count during CPU offline operations may result in a race condition. An attacker with local access to the system could exploit this vulnerability to disrupt system operations or gain elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just a manifest file like package-lock.json.
Yes, a patch for this vulnerability is available in the Linux Kernel version v5.14.15. Users can update their kernel to this version or later to mitigate the vulnerability.
No, this vulnerability requires local access to the affected system in order to be exploited.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
