Memory Leak in pm8001_chip_fw_flash_update_req() in Kernel
Summary
GSD-2022-1001396: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req(). Affects Kernel versions < fe5b8ea5583b5c3f6f68e06acba50387edf3b5d5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities for the proper functioning of the system. The pm8001 driver is responsible for managing SAS/SATA controllers based on the PM8001 chip. These controllers are commonly used in storage devices. However, a vulnerability has been discovered in the pm8001_chip_fw_flash_update_req() function, which can lead to a memory leak.
Vulnerability Detail
The vulnerability resides in the pm8001_chip_fw_flash_update_req() function of the pm8001 driver in the Kernel. When this function is called, it fails to release allocated memory, resulting in a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory resources, leading to a denial-of-service condition. The impact of this vulnerability can vary depending on the system's memory capacity and the attacker's ability to trigger the vulnerable function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the exploitation of this vulnerability by refraining from executing any code or actions that trigger the pm8001_chip_fw_flash_update_req() function. However, this workaround may limit the functionality of the affected system, and it is strongly recommended to apply the official fix by updating the Kernel.
Conclusion
In conclusion, the pm8001_chip_fw_flash_update_req() function in the Kernel is vulnerable to a memory leak issue. This vulnerability can potentially lead to a denial-of-service condition by exhausting system memory resources. It is crucial to update the Linux Kernel to version v5.16.20 or later to mitigate this vulnerability. Users can also use Vulert's playground to check if their system is affected and obtain real-time alerts for open-source vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the system's memory capacity and the attacker's ability to trigger the vulnerable function. In worst-case scenarios, it can lead to a denial-of-service condition by exhausting system memory resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify and alert in real-time for open-source vulnerabilities, including this one.
Yes, a workaround is available. Users can avoid the exploitation of this vulnerability by refraining from executing any code or actions that trigger the pm8001_chip_fw_flash_update_req() function. However, it is strongly recommended to apply the official fix by updating the Kernel.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.20 or later. This update includes a commit (fe5b8ea5583b5c3f6f68e06acba50387edf3b5d5) that addresses the memory leak issue in the pm8001_chip_fw_flash_update_req() function. Users can obtain the updated Kernel from the official Linux Kernel repository.
You can find more information about this vulnerability in the GSD-2022-1001396 entry of the GSD database maintained by the Cloud Security Alliance. The entry provides additional details, including the source of the vulnerability and the fix commit in the Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
