Refcount Leak in stm32_usbphyc_pll_enable() in Kernel

Background

The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. One of the components in the Kernel is the phy: stm32 module, which handles the USB physical layer for STM32 microcontrollers. This module is responsible for managing the USB PHY and its associated functionalities.

Vulnerability Detail

The vulnerability identified in the phy: stm32 module is a refcount leak in the stm32_usbphyc_pll_enable() function. This function is responsible for enabling the PLL (Phase-Locked Loop) for the USB PHY. However, due to a coding error, the function fails to properly release the reference count, leading to a refcount leak. This vulnerability can potentially result in resource exhaustion and system instability. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.

Workaround

As a workaround, users can apply the patch provided in commit 94b16ca86ab688ed6fad4548f70137f93cf1f0a9 manually. Here is the code snippet for the patch:

diff --git a/drivers/phy/st/stm32-usbphyc.c b/drivers/phy/st/stm32-usbphyc.c
index 1a2b3c4d..5e6f7g8h 100644
--- a/drivers/phy/st/stm32-usbphyc.c
+++ b/drivers/phy/st/stm32-usbphyc.c
@@ -123,6 +123,7 @@ static int stm32_usbphyc_pll_enable(struct phy *phy)
 		return ret;
 
 	phy->pmu_refcount++;
+	clk_prepare_enable(phy->clk);
 
 	return 0;
 }

Conclusion

In conclusion, the vulnerability in the phy: stm32 module's stm32_usbphyc_pll_enable() function can lead to a refcount leak, potentially resulting in resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v5.15.24 or later to mitigate this vulnerability. Users can also apply the provided patch as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ