Missing of_node_put() in octeon2_usb_clocks_start in Kernel
Summary
GSD-2022-1005954: mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start. Affects Kernel versions < 1b49707df679b5510ed06ace7378ddc2aec5c3fb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the system's resources and facilitates communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The vulnerability in question affects the mips: cavium-octeon package within the Kernel. This package is responsible for supporting the Cavium Octeon MIPS-based processors. The specific vulnerability occurs in the octeon2_usb_clocks_start function, where a call to of_node_put() is missing. This omission can lead to resource leaks and potential security issues.
Vulnerability Detail
The missing of_node_put() in octeon2_usb_clocks_start vulnerability in the mips: cavium-octeon package can result in resource leaks and potential security risks. When the function is called without the corresponding of_node_put() call, it can cause a reference count imbalance, leading to memory leaks and potential use-after-free vulnerabilities. Attackers may be able to exploit these vulnerabilities to execute arbitrary code or cause a denial of service. It is important to address this vulnerability promptly to mitigate these risks.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, the missing of_node_put() call in the octeon2_usb_clocks_start function needs to be added. This can be achieved by modifying the code to include the appropriate of_node_put() call after the relevant operations are completed. The fix has been implemented in Linux Kernel version v5.4.211 by commit 1b49707df679b5510ed06ace7378ddc2aec5c3fb. It is recommended to update to this version or a later one to ensure the vulnerability is resolved.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The missing of_node_put() in octeon2_usb_clocks_start vulnerability in the mips: cavium-octeon package within the Kernel can lead to resource leaks and potential security risks. It is crucial to update to Linux Kernel version v5.4.211 or a later version that includes commit 1b49707df679b5510ed06ace7378ddc2aec5c3fb to address this vulnerability. Failure to do so may expose the system to potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in resource leaks and potential security risks. Attackers may exploit these vulnerabilities to execute arbitrary code or cause a denial of service.
To fix this vulnerability, update to Linux Kernel version v5.4.211 or a later version that includes commit 1b49707df679b5510ed06ace7378ddc2aec5c3fb.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix provided in the updated version of the Kernel.
At the time of this report, no known exploits have been identified for this vulnerability. However, it is crucial to address the vulnerability promptly to mitigate potential risks.
For more information about this vulnerability, you can refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.