PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
Summary
GSD-2022-1000636: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault. Affects Kernel versions >= 8edf5332c39340b9583cf9cba659eb7ec71f75b5, < 6d6f1f0dac3e3441ecdb1103d4efb11b9ed24dd5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PCI package in the Linux Kernel is responsible for managing PCI devices and their interactions with the system. It provides support for hot-plugging and power management of PCI devices. The pciehp module specifically handles hot-plug events for PCI Express (PCIe) devices. It monitors the PCIe slots for device insertion or removal and performs the necessary actions to enable or disable the devices.
Vulnerability Detail
The vulnerability in the pciehp module of the Linux Kernel allows for an infinite loop in the IRQ handler when a power fault occurs. This can be triggered by a power fault event in a PCIe slot, causing the IRQ handler to enter an infinite loop and consuming excessive CPU resources. This vulnerability can lead to a denial-of-service (DoS) condition, rendering the system unresponsive and impacting its availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the Linux Kernel to the fixed version.
Conclusion
The vulnerability in the pciehp module of the Linux Kernel can lead to a denial-of-service (DoS) condition by causing an infinite loop in the IRQ handler upon a power fault event. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.16.6 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition, causing the system to become unresponsive and impacting its availability.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if the vulnerability is present.
No, there is no known workaround for this vulnerability. It is necessary to update the Linux Kernel to the fixed version.
You can find more information about the fix in the Linux Kernel repository. The commit 6d6f1f0dac3e3441ecdb1103d4efb11b9ed24dd5 addresses this vulnerability.
Yes, this vulnerability was introduced in version v5.7 of the Linux Kernel. It is recommended to update to version v5.16.6 or later to fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
