Infinite Loop Vulnerability in PCI: pciehp Package
Summary
GSD-2022-1000204: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault. Affects Kernel versions >= 8edf5332c39340b9583cf9cba659eb7ec71f75b5, < 3b4c966fb156ff3e70b2526d964952ff7c1574d9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PCI: pciehp package is a component of the Linux Kernel that handles hot-plug events for PCI Express devices. It provides support for detecting and configuring PCIe hot-plug slots in a system. This package is widely used in Linux-based systems and is critical for the proper functioning of PCIe devices.
Vulnerability Detail
The vulnerability identified in the PCI: pciehp package is an infinite loop issue that occurs in the IRQ handler when a power fault is encountered. This flaw allows an attacker to trigger the infinite loop by exploiting a power fault condition, leading to a denial-of-service (DoS) situation. The infinite loop consumes excessive system resources, rendering the affected system unresponsive and potentially impacting the availability of other critical services.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected PCIe hot-plug slots in the system BIOS or firmware. This prevents the IRQ handler from being triggered by power faults and mitigates the risk of encountering the infinite loop. However, this workaround may limit the hot-plug functionality of PCIe devices in the system.
Conclusion
The infinite loop vulnerability in the PCI: pciehp package can lead to a denial-of-service situation by causing the IRQ handler to enter an infinite loop upon encountering a power fault. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.10.97 or later. Disabling the affected PCIe hot-plug slots in the system BIOS or firmware can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service (DoS) situation by causing an infinite loop in the IRQ handler. This can render the affected system unresponsive and impact the availability of critical services.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you in real-time if the vulnerability is present.
Yes, the vulnerability has been fixed in Linux Kernel version v5.10.97. It is recommended to update the Kernel to this version or later to resolve the issue.
As a temporary workaround, you can disable the affected PCIe hot-plug slots in the system BIOS or firmware. This prevents the IRQ handler from being triggered by power faults and mitigates the risk of encountering the infinite loop. However, this workaround may limit the hot-plug functionality of PCIe devices in the system.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry GSD-2022-1000204 at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000204.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
