Fix GICR_CTLR.RWP polling in irqchip/gic-v3
Summary
GSD-2022-1001001: irqchip/gic-v3: Fix GICR_CTLR.RWP polling. Affects Kernel versions >= 021f653791ad17e03f98aaa7fb933816ae16f161, < 6fef3e3179e6ed8fecdd004ede541674ffa7749d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and user applications. The irqchip/gic-v3 module within the Kernel package is responsible for managing interrupt requests on systems with GICv3-compatible interrupt controllers. It is a critical component for proper system operation and performance.
Vulnerability Detail
The vulnerability in irqchip/gic-v3 arises from a flaw in the GICR_CTLR.RWP polling mechanism. This flaw can potentially be exploited by an attacker to manipulate the interrupt controller's control register and disrupt the proper functioning of interrupt handling. The impact of this vulnerability can range from system instability and crashes to potential privilege escalation attacks. The vulnerability was introduced in version v3.17 of the Linux Kernel and has been fixed in version v5.17.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Kernel package to the recommended version.
Conclusion
The vulnerability in irqchip/gic-v3's GICR_CTLR.RWP polling mechanism can have severe consequences for system stability and security. It is crucial to update the Kernel package to the fixed version to mitigate the risk. No known workarounds are available, and it is recommended to apply the fix as soon as possible. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to system instability, crashes, and potential privilege escalation attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities.
Unfortunately, there are no known temporary measures or workarounds for this vulnerability. It is crucial to update the Kernel package to the fixed version as soon as possible.
You can refer to the official Linux Kernel Git repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) for detailed information about the fix. The vulnerability details are also available in the GSD-2022-1001001 JSON report (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001001.json).
For further support and assistance regarding vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
