Vulnerability in spi: uniphier package - Reference Count Leak in uniphier_spi_probe()
Summary
GSD-2022-1000670: spi: uniphier: fix reference count leak in uniphier_spi_probe(). Affects Kernel versions >= 28d1dddc59f6b7fc085093e7c1e978b33f0caf4c, < 447c3d4046d7b54052d07d8b27e15e6edea5662c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi: uniphier package is a component of the Linux Kernel ecosystem. It provides support for SPI (Serial Peripheral Interface) controllers found in the UniPhier SoC family of devices. SPI is a synchronous serial communication interface commonly used for connecting microcontrollers, sensors, and other peripheral devices. The uniphier_spi_probe() function is responsible for initializing and probing the UniPhier SPI controller. However, a reference count leak vulnerability has been identified in this function.
Vulnerability Detail
The vulnerability in spi: uniphier arises due to a reference count leak in the uniphier_spi_probe() function. This leak can lead to incorrect reference counting, potentially resulting in resource leaks or use-after-free conditions. An attacker with local access to the affected system may be able to exploit this vulnerability to gain elevated privileges or cause a denial-of-service (DoS) condition. The vulnerability was introduced in version v5.6 of the Linux Kernel and has been fixed in version v5.16.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to disable the affected SPI controller or module. This can be achieved by modifying the system's configuration or disabling the SPI driver. However, it is important to note that this workaround may impact the functionality of devices relying on the SPI controller.
Conclusion
In conclusion, the spi: uniphier package in the Linux Kernel is vulnerable to a reference count leak in the uniphier_spi_probe() function. This vulnerability can have serious consequences, including resource leaks, use-after-free conditions, and potential privilege escalation or denial-of-service attacks. It is crucial to update the Kernel to version v5.16.8 or later to address this vulnerability. If immediate updating is not possible, consider disabling the affected SPI controller or module as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The spi: uniphier package is a component of the Linux Kernel ecosystem that provides support for SPI controllers in UniPhier SoC devices.
The vulnerability can lead to resource leaks or use-after-free conditions, potentially enabling an attacker to gain elevated privileges or cause a denial-of-service (DoS) condition.
To fix this vulnerability, update the Linux Kernel to version v5.16.8 or later, which includes the necessary patch.
A possible workaround is to disable the affected SPI controller or module, but this may impact the functionality of devices relying on it.
There is no known exploit for this vulnerability at the moment. However, it is recommended to apply the patch as soon as possible to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
