mtd: parsers: qcom: Fix missing free for pparts in cleanup
Summary
GSD-2022-1000561: mtd: parsers: qcom: Fix missing free for pparts in cleanup. Affects Kernel versions >= 10f3b4d79958d6f9f71588c6fa862159c83fa80f, < 1b37889f9a151d26a3fb0d3870f6e1046dee2e24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mtd (Memory Technology Device) subsystem in the Linux Kernel provides an abstraction layer for interacting with different types of flash memory devices. One of the parsers in the mtd subsystem is the qcom parser, which is responsible for parsing partition tables specific to Qualcomm devices. This parser is used to extract information about flash partitions, such as their names and sizes, from the partition table. However, a vulnerability has been discovered in the qcom parser that leads to a missing free operation for pparts in the cleanup process.
Vulnerability Detail
The vulnerability in the qcom parser arises due to a missing free operation for pparts in the cleanup code. When the parser encounters an error during the parsing process, it jumps to the 'cleanup' label to free allocated resources and return an error code. However, the 'cleanup' code fails to free the 'pparts' variable, which can result in a memory leak. An attacker who can trigger the error condition in the parser could potentially exhaust system memory resources, leading to a denial-of-service (DoS) scenario. The impact of this vulnerability depends on the specific use case and the availability of error-triggering conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by ensuring they are running a version of the Linux Kernel that includes the fix.
Conclusion
The qcom parser in the mtd subsystem of the Linux Kernel is vulnerable to a missing free operation for 'pparts' in the cleanup code. This vulnerability can potentially lead to a memory leak and a denial-of-service (DoS) scenario. It is recommended to update to the Linux Kernel version v5.16.11 or any subsequent version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The mtd (Memory Technology Device) subsystem in the Linux Kernel provides an abstraction layer for interacting with different types of flash memory devices. It allows applications to access and manage flash memory in a consistent manner, regardless of the underlying hardware.
The qcom parser is a component of the mtd subsystem that is responsible for parsing partition tables specific to Qualcomm devices. It extracts information about flash partitions, such as their names and sizes, from the partition table.
The missing free operation in the qcom parser's cleanup code can result in a memory leak when an error occurs during the parsing process. This can potentially lead to a denial-of-service (DoS) scenario if an attacker can trigger the error condition and exhaust system memory resources.
To fix this vulnerability, it is recommended to update to the Linux Kernel version v5.16.11 or any subsequent version that includes the fix. The fix adds the missing free operation for 'pparts' in the qcom parser's cleanup code.
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by ensuring they are running a version of the Linux Kernel that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
