Missing Free in wm8350-power Charger IRQ
Summary
GSD-2022-1001218: power: supply: wm8350-power: Add missing free in free_charger_irq. Affects Kernel versions >= 14431aa0c5a443d13d24e6f865a8838f97dab973, < 011ce263361608bb2a1a5cbcc0e3c53b1d7a41d7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wm8350-power module is responsible for managing power supply on devices that use the WM8350 power management IC. It provides support for various power sources, including battery charging. The module handles the initialization and control of the charger IRQ, which is used to detect charging events and trigger corresponding actions. However, a missing 'free' operation in the free_charger_irq function can lead to resource leaks and potential instability in the power management subsystem.
Vulnerability Detail
The vulnerability arises from the omission of a 'free' operation in the free_charger_irq function of the wm8350-power module. This oversight can result in resource leaks, leading to memory corruption or depletion. An attacker with access to the affected device could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually add the missing 'free' operation in the free_charger_irq function of the wm8350-power module. Here is an example of the code modification:
void free_charger_irq(struct wm8350 *wm8350)
{
// Existing code
...
// Add the missing 'free' operation
free_irq(wm8350->charger_irq, wm8350);
}
Conclusion
The missing 'free' operation in the free_charger_irq function of the wm8350-power module can lead to resource leaks and potential instability in the power management subsystem. It is recommended to update the Linux Kernel to version v5.17.2 or later to fix this vulnerability. In the meantime, a temporary workaround is available by manually adding the missing 'free' operation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The wm8350-power module is a component of the Linux Kernel that handles power supply management for devices utilizing the WM8350 power management IC. It provides support for various power sources, including battery charging.
The impact of this vulnerability can range from resource leaks and potential memory corruption to a denial-of-service (DoS) condition or arbitrary code execution with elevated privileges. However, the actual impact and attack plausibility have not been proven yet.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.2 or later. The fix for this issue was implemented in commit 011ce263361608bb2a1a5cbcc0e3c53b1d7a41d7.
Yes, as a temporary workaround, users can manually add the missing 'free' operation in the free_charger_irq function of the wm8350-power module. Please refer to the 'workaround' section for code modification details.
For more information about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001218.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
