PowerPC/idle: Back Chain Corruption Vulnerability in Kernel
Summary
GSD-2021-1002178: powerpc/idle: Don't corrupt back chain when going idle. Affects Kernel versions >= 9b4416c5095c20e110c82ae602c254099b83b72f, < 496c5fe25c377ddb7815c4ce8ecfb676f051e9b6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The PowerPC/idle module in the Kernel is responsible for managing the idle state of PowerPC processors. When the system is idle, this module ensures efficient power consumption and reduces unnecessary processing. However, a vulnerability has been discovered in the PowerPC/idle module that can lead to back chain corruption when the system goes idle.
Vulnerability Detail
The PowerPC/idle vulnerability occurs when the system transitions to an idle state. It corrupts the back chain, which is a data structure used to maintain the call stack during function calls. This corruption can result in various issues, including crashes, data corruption, and potential privilege escalation attacks. The vulnerability was introduced in Linux Kernel version v5.15 by commit 9b4416c5095c20e110c82ae602c254099b83b72f and is fixed in version v5.15 by commit 496c5fe25c377ddb7815c4ce8ecfb676f051e9b6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating the Linux Kernel.
Conclusion
The PowerPC/idle back chain corruption vulnerability in the Kernel can have severe consequences, including system crashes, data corruption, and potential privilege escalation. It is highly recommended to update the Linux Kernel to version v5.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to system crashes, data corruption, and potential privilege escalation attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and receive real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for the PowerPC/idle back chain corruption vulnerability.
The vulnerability requires local access to the system to exploit. However, if successfully exploited, it can lead to remote code execution or privilege escalation.
Unfortunately, there are no known mitigations for this vulnerability. It is crucial to update the Linux Kernel as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
