Uniphier SPI Reference Count Leak in Linux Kernel
Summary
GSD-2022-1000227: spi: uniphier: fix reference count leak in uniphier_spi_probe(). Affects Kernel versions >= 28d1dddc59f6b7fc085093e7c1e978b33f0caf4c, < e895e067d73e154b1ebc84a124e00831e311d9b0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Uniphier SPI driver is a component of the Linux Kernel that provides support for the SPI (Serial Peripheral Interface) controller found on Uniphier SoCs (System-on-Chips). SPI is a synchronous serial communication interface commonly used for connecting microcontrollers, sensors, and other peripheral devices to a central processing unit. The Uniphier SPI driver allows the Linux Kernel to communicate with SPI devices on Uniphier-based systems. However, a reference count leak vulnerability has been identified in the Uniphier SPI driver.
Vulnerability Detail
The vulnerability in the Uniphier SPI driver is caused by a reference count leak in the uniphier_spi_probe() function. This function is responsible for initializing the SPI controller and registering it with the Linux Kernel. The reference count leak occurs when the probe function is called multiple times without a corresponding release of the reference count. This can lead to a resource leak, potentially causing system instability or denial of service. The vulnerability was introduced in Linux Kernel version v5.6 and has been fixed in version v5.10.99.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel as mentioned in the 'how_to_fix' section.
Conclusion
The Uniphier SPI driver in the Linux Kernel is vulnerable to a reference count leak, which can lead to system instability or denial of service. It is recommended to update the Linux Kernel to version v5.10.99 or later to fix this vulnerability. No specific workaround is available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Uniphier SPI driver is a component of the Linux Kernel that provides support for the SPI controller found on Uniphier SoCs. It allows the Linux Kernel to communicate with SPI devices on Uniphier-based systems.
A reference count leak occurs when the reference count of a resource is not properly released, leading to a resource leak. In the case of the Uniphier SPI driver, the reference count leak can cause system instability or denial of service.
The potential ramifications of this vulnerability include system instability and denial of service. If the reference count leak is exploited, it can lead to a resource leak, potentially causing the system to become unstable or unresponsive.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the Vulert Playground, and it will analyze the dependencies and alert you if any vulnerabilities, including this one, are found.
For more information about this vulnerability, you can refer to the vulnerability details in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000227.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
