Refcount Leak in powerpc/secvar Package
Summary
GSD-2022-1001044: powerpc/secvar: fix refcount leak in format_show(). Affects Kernel versions < d05e4265d33af60b39606c20c731e3e719bfe3d6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The powerpc/secvar package is a component of the Linux Kernel, specifically designed for powerpc architecture. It is responsible for managing secure variables on powerpc-based systems. These secure variables store critical information related to system security, such as cryptographic keys and secure boot configurations.
Vulnerability Detail
The vulnerability identified in the powerpc/secvar package is a refcount leak in the format_show() function. This function is used to format and display secure variable information to users. Due to a coding error, the refcount (reference count) of secure variables is not properly decremented after being accessed, leading to a resource leak. An attacker with local access to the system could exploit this vulnerability to exhaust system resources, potentially causing a denial-of-service (DoS) condition. However, the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the powerpc/secvar package in the Linux Kernel is vulnerable to a refcount leak in the format_show() function. This vulnerability could potentially lead to a denial-of-service (DoS) condition. To mitigate the risk, it is advised to update the Linux Kernel to version v5.17.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to a denial-of-service (DoS) condition by exhausting system resources. However, the actual impact and attack plausibility have not been proven yet.
Any system running the powerpc/secvar package in the Linux Kernel prior to version v5.17.3 is affected by this vulnerability.
No, this vulnerability requires local access to the system in order to be exploited.
No, there are no known workarounds for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
No, there is no evidence of active exploits targeting this vulnerability at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
