PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
Summary
GSD-2022-1000161: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault. Affects Kernel versions >= 4667358dab9cc07da044d5bc087065545b1000df, < 464da38ba827f670deac6500a1de9a4f0f44c41d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware and software components. The pciehp module within the Kernel is responsible for handling hot-plug events for PCI Express devices. It manages the insertion and removal of PCIe cards while the system is running. However, a vulnerability has been discovered in the IRQ handler of pciehp, which can lead to an infinite loop when a power fault occurs.
Vulnerability Detail
The vulnerability in the pciehp IRQ handler can be triggered when a power fault event is encountered. This can occur due to a hardware malfunction or an external power disruption. When the IRQ handler encounters this event, it enters an infinite loop, causing the system to hang or become unresponsive. An attacker with physical access to the system could exploit this vulnerability to cause a denial-of-service (DoS) condition. The impact of this vulnerability has not been fully assessed, but it has the potential to disrupt critical system operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the pciehp module to prevent the vulnerability from being exploited. This can be achieved by blacklisting the module or removing it from the Kernel configuration. However, it is important to note that disabling the pciehp module may result in the loss of hot-plug functionality for PCIe devices.
Conclusion
The pciehp IRQ handler vulnerability in the Kernel package can lead to an infinite loop and system hang when a power fault occurs. It is crucial to update the Kernel to version v5.4.177 or later to fix this issue. Alternatively, users can temporarily disable the pciehp module, but this may result in the loss of hot-plug functionality for PCIe devices. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not fully known, but it has the potential to cause a denial-of-service (DoS) condition and disrupt critical system operations.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Yes, a temporary workaround is to disable the pciehp module. However, this may result in the loss of hot-plug functionality for PCIe devices.
The updated Kernel version (v5.4.177 or later) can be obtained from the official Linux Kernel repository. Detailed instructions on how to update the Kernel can be found in the Kernel documentation.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the recommended fix or workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
