Vulnerability in mt76 DMA Initialization in Kernel
Summary
GSD-2022-1001407: mt76: dma: initialize skip_unmap in mt76_dma_rx_fill. Affects Kernel versions < db0e611405eb32f8d60531853a5c5210347b5d57. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, and MT7663 wireless LAN chipsets. It provides support for various features and functionalities of these chipsets, including DMA operations. DMA (Direct Memory Access) is a mechanism that allows hardware devices to transfer data directly to and from the system memory without involving the CPU. This vulnerability specifically affects the DMA initialization process in mt76.
Vulnerability Detail
The vulnerability exists in the mt76_dma_rx_fill function of the mt76 DMA implementation. The skip_unmap variable used in this function is not properly initialized, which can lead to uninitialized memory access and potential security issues. An attacker may be able to exploit this vulnerability to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the commit db0e611405eb32f8d60531853a5c5210347b5d57 manually to their Kernel source code. Here is the code snippet for the patch:
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -123,6 +123,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
struct mt76_rx_status *status;
struct mt76_rxwi_cache *rxwi;
struct mt76_rxwi *rxwi_ptr;
+ bool skip_unmap = false;
status = mt76_dma_rx_status(dev, q, idx);
if (!status)
Conclusion
In conclusion, the mt76 DMA initialization vulnerability can potentially lead to security issues. It is recommended to update the Linux Kernel to the latest version or apply the provided patch to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mt76 is a driver package for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, and MT7663 wireless LAN chipsets. It provides support for various features and functionalities of these chipsets.
DMA (Direct Memory Access) is a mechanism that allows hardware devices to transfer data directly to and from the system memory without involving the CPU. It improves data transfer efficiency and reduces CPU overhead.
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition.
To fix this vulnerability, update your Linux Kernel to version v5.16.20 or later. This fix is implemented in commit db0e611405eb32f8d60531853a5c5210347b5d57 of the Linux Kernel repository.
Yes, you can manually apply the patch provided in the commit db0e611405eb32f8d60531853a5c5210347b5d57 to your Kernel source code.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
