Vulnerability in ASoC: atmel Package - Missing of_node_put() in at91sam9g20ek_audio_probe

Background

The ASoC (Audio System on Chip) package, specifically the atmel component, is responsible for providing audio support for Atmel processors. It enables audio input and output functionalities on Atmel-based devices. The at91sam9g20ek_audio_probe function within the package is responsible for initializing the audio subsystem on the Atmel AT91SAM9G20EK development board. However, a missing of_node_put() call in this function can lead to a resource leak, potentially causing memory exhaustion and system instability.

Vulnerability Detail

The vulnerability arises from the absence of an of_node_put() call in the at91sam9g20ek_audio_probe function of the ASoC atmel package. This omission can result in a resource leak, where the reference count of the device tree node is not properly decremented. As a consequence, memory may not be released, leading to memory exhaustion and potential system instability. An attacker with local access to the affected device could potentially exploit this vulnerability to exhaust system resources, causing a denial-of-service (DoS) condition.

Workaround

As a workaround, users can manually add the missing of_node_put() call in the at91sam9g20ek_audio_probe function of the ASoC atmel package. The following code snippet demonstrates the addition:

static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
{
    // Existing code

    // Add the following line
    of_node_put(pdev->dev.of_node);

    // Existing code
}

Conclusion

The ASoC atmel package contains a vulnerability in the at91sam9g20ek_audio_probe function, where a missing of_node_put() call can lead to a resource leak and potential system instability. To mitigate this vulnerability, it is crucial to apply the fix provided in Linux Kernel version v5.17.2. Alternatively, users can manually add the missing of_node_put() call as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ