Missing pm_runtime_put_sync in drm/bridge package
Summary
GSD-2022-1001072: drm/bridge: Add missing pm_runtime_put_sync. Affects Kernel versions < 9df80dc738926a2ea4bd1ce5993c3d0f4b0e855c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/bridge package is a component of the Linux Kernel that provides support for display bridges, which are responsible for connecting display controllers to display panels. This package plays a crucial role in enabling the proper functioning of graphics and display systems in Linux-based operating systems. However, a vulnerability has been identified in the package that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the drm/bridge package involves a missing pm_runtime_put_sync function call. This function is responsible for properly managing power state transitions in the system. Without this call, there is a risk of power management issues, which could result in unexpected behavior or system instability. Attackers may be able to exploit this vulnerability to gain unauthorized access or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the Linux Kernel to the latest version.
Conclusion
In conclusion, the missing pm_runtime_put_sync vulnerability in the drm/bridge package of the Linux Kernel could lead to power management issues and potential security risks. It is crucial to update the Linux Kernel to version v5.17.3 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could lead to power management issues, resulting in unexpected behavior or system instability. It may also provide an avenue for attackers to exploit the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for any open-source vulnerabilities, including this one.
At the time of this report, no known exploits have been documented for this specific vulnerability. However, it is still important to apply the recommended fix to ensure the security and stability of your system.
While it may be possible to manually add the missing function call, it is strongly recommended to update the Linux Kernel to the latest version instead. This ensures that all necessary fixes and updates are applied correctly.
You can find more information about this vulnerability, including its impact and the fix, in the official Linux Kernel repository. The vulnerability ID GSD-2022-1001072 provides additional details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
