Vulnerability in Kernel: usb: host: ohci-tmio: check return value after calling platform_get_resource()
Summary
GSD-2021-1002240: usb: host: ohci-tmio: check return value after calling platform_get_resource(). Affects Kernel versions < bb6ed2e05eb6e8619b30fa854f9becd50c11723f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, including memory, processes, and input/output operations. The usb: host: ohci-tmio module is responsible for supporting USB host functionality on the Toshiba Mobile IO Controller. It allows communication between the system and USB devices connected to it. However, a vulnerability has been discovered in this module that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the usb: host: ohci-tmio module arises from a failure to check the return value after calling platform_get_resource(). This oversight could result in the module incorrectly accessing system resources or failing to handle them properly. An attacker could potentially exploit this vulnerability to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v4.14.256 by commit bb6ed2e05eb6e8619b30fa854f9becd50c11723f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, a vulnerability has been identified in the usb: host: ohci-tmio module of the Kernel, which could potentially lead to unauthorized access, code execution, or denial-of-service. It is crucial to update the Kernel to version v4.14.256 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially allow an attacker to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition.
There is no evidence to suggest that this vulnerability has been exploited in the wild at this time.
The vulnerability is present in versions of the Kernel prior to v4.14.256. The fixed version of the Kernel addresses this vulnerability.
The recommended approach to mitigate this vulnerability is to update the Kernel to the fixed version. However, if updating is not immediately feasible, other security measures such as network segmentation and access controls can help reduce the risk.
More information about this vulnerability can be found in the vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID is GSD-2021-1002240.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
