String Overflow Vulnerability in SCPI genpd Driver in Kernel
Summary
GSD-2021-1002645: firmware: arm_scpi: Fix string overflow in SCPI genpd driver. Affects Kernel versions >= 8bec4337ad4023b26de35d3b0c3a3b2735ffc5c7, < 7e8645ca2c0046f7cd2f0f7d569fc036c8abaedb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SCPI genpd driver is a component of the Linux Kernel that manages power domains for ARM-based systems. It provides functionality for controlling the power state of various hardware components. The driver uses SCPI (System Control and Power Interface) commands to communicate with the firmware and control the power domains. The vulnerability in the SCPI genpd driver allows for a string overflow, which can lead to memory corruption and potentially enable an attacker to execute arbitrary code or cause a denial-of-service condition.
Vulnerability Detail
The vulnerability arises from a string overflow in the SCPI genpd driver. When processing certain SCPI commands, the driver does not properly validate the length of input strings, leading to a buffer overflow. An attacker can exploit this by sending a specially crafted SCPI command that exceeds the buffer size, causing the overflow and potentially overwriting adjacent memory regions. This can result in arbitrary code execution or system crashes. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply patches provided by the Linux Kernel community or disable the affected functionality if it is not essential for their system. However, it is strongly recommended to update to the latest Kernel version to fully mitigate the vulnerability.
Conclusion
The string overflow vulnerability in the SCPI genpd driver in the Linux Kernel can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is crucial to update the Kernel to version v4.19.222 or later to mitigate this vulnerability. Applying patches or disabling the affected functionality can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The SCPI genpd driver is a component of the Linux Kernel that manages power domains for ARM-based systems. It controls the power state of various hardware components.
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition by exploiting the string overflow in the SCPI genpd driver.
To fix this vulnerability, update the Linux Kernel to version v4.19.222 or later, which includes the patch for this issue.
Users can apply patches provided by the Linux Kernel community or disable the affected functionality if it is not essential for their system. However, updating to the latest Kernel version is the recommended approach.
No proof of concept or exploit has been provided at this time. The impact and attack plausibility of this vulnerability have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
