Vulnerability in Kernel: powerpc/perf
Summary
GSD-2022-1000200: powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending. Affects Kernel versions >= ef798cd035f316a537fee8ed170c127f12407085, < 55402a4618721f350a9ab660bb42717d8aa18e7c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces between hardware and software. It is responsible for managing system resources, including memory, processes, and device drivers. The powerpc/perf module within the Kernel is specifically designed for performance monitoring on PowerPC-based systems. It allows users to collect and analyze performance data to optimize system performance. However, a vulnerability has been discovered in the power_pmu_disable function, which can lead to potential security issues.
Vulnerability Detail
The power_pmu_disable function in powerpc/perf module of the Kernel does not correctly handle the clearing of Performance Monitor Interrupt (PMI) pending status. This can result in a situation where the PMI interrupt is not properly cleared, leading to potential security vulnerabilities. An attacker could exploit this vulnerability to execute arbitrary code or escalate privileges on a vulnerable system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Kernel to the fixed version as soon as possible.
Conclusion
In conclusion, a vulnerability has been discovered in the powerpc/perf module of the Kernel, which can potentially lead to security issues. It is crucial to update the Linux Kernel to version v5.10.96 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, an attacker could execute arbitrary code or escalate privileges on a vulnerable system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
This vulnerability was introduced in version v5.10.94 by commit ef798cd035f316a537fee8ed170c127f12407085. It is fixed in version v5.10.96 by commit 55402a4618721f350a9ab660bb42717d8aa18e7c. Therefore, versions between v5.10.94 and v5.10.96 (inclusive) are affected.
Yes, a patch is available in the form of an updated version of the Linux Kernel. It is recommended to update to version v5.10.96 or later to fix this vulnerability.
You can find more information about this vulnerability in the GSD-2022-1000200 entry of the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000200.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
