Vulnerability in coresight: syscfg: Fix memleak on registration failure in cscfg_create_device
Summary
GSD-2022-1001321: coresight: syscfg: Fix memleak on registration failure in cscfg_create_device. Affects Kernel versions >= 85e2414c518a03a21dddd4bc88fec2723c5e1197, < 412225b32986d5b11c3c1ad9234c50a3f5c52c76. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coresight package is a component of the Linux Kernel that provides support for debugging and tracing on ARM-based systems. It includes various features and drivers for accessing and configuring CoreSight components, which are hardware debug and trace modules. One of these components is syscfg, which is responsible for managing the configuration of CoreSight devices. The vulnerability in question relates to a memory leak that occurs when registration fails during the creation of a device using the cscfg_create_device function.
Vulnerability Detail
The vulnerability arises from a failure to properly release allocated memory when registration fails during the creation of a CoreSight device. This can lead to a memory leak, where memory resources are not freed, potentially causing performance degradation or exhaustion of available memory. An attacker may be able to exploit this vulnerability to exhaust system resources, leading to a denial-of-service condition. The vulnerability was introduced in Linux Kernel version v5.15 and has been fixed in version v5.17.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
In conclusion, the coresight package in the Linux Kernel is vulnerable to a memory leak issue when registration fails during the creation of a CoreSight device. This can lead to performance degradation or exhaustion of available memory. It is recommended to update the Linux Kernel to version v5.17.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Coresight is a component of the Linux Kernel that provides support for debugging and tracing on ARM-based systems. It includes various features and drivers for accessing and configuring CoreSight components, which are hardware debug and trace modules.
Syscfg is a component of coresight that is responsible for managing the configuration of CoreSight devices.
cscfg_create_device is a function in coresight that is used to create a CoreSight device. It is affected by the vulnerability described in this report.
The vulnerability can lead to a memory leak, potentially causing performance degradation or exhaustion of available memory. An attacker may be able to exploit this vulnerability to exhaust system resources, leading to a denial-of-service condition.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.2 or later. This can be done by pulling the latest changes from the official Linux Kernel repository and rebuilding the kernel. Alternatively, users can wait for their Linux distribution to provide an updated package containing the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
