Missing pm_runtime_put_sync in drm/bridge package
Summary
GSD-2022-1001409: drm/bridge: Add missing pm_runtime_put_sync. Affects Kernel versions < 792533e54cd6e89191798ccd1abd590c62b9077e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/bridge package is a component of the Linux Kernel that provides support for display bridges, which are responsible for connecting display controllers to display panels. This package is crucial for enabling the proper functioning of graphics and display features in Linux-based systems. However, a vulnerability has been identified in the package that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the drm/bridge package involves a missing pm_runtime_put_sync function call. This function is responsible for properly managing power state transitions in the system. Without this call, there is a possibility of power management-related issues, such as incorrect power state handling or resource leaks. Although the exact impact and attack vectors have not been proven, it is important to address this vulnerability to ensure the stability and security of the system.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.20 or later. This update includes the commit 792533e54cd6e89191798ccd1abd590c62b9077e, which adds the missing pm_runtime_put_sync function call. By applying this update, the power management issue in the drm/bridge package can be resolved.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by manually adding the missing pm_runtime_put_sync function call in the affected code. Here is an example of how the call can be added:
...
pm_runtime_put_sync(&bridge->dev);
...
Conclusion
In conclusion, the drm/bridge package in the Linux Kernel is affected by a vulnerability involving a missing pm_runtime_put_sync function call. This vulnerability could potentially lead to power management-related issues. To address this vulnerability, it is recommended to update the Linux Kernel to version v5.16.20 or later. Alternatively, a temporary workaround can be implemented by manually adding the missing function call in the affected code. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is not yet proven. However, it could potentially lead to power management-related issues, such as incorrect power state handling or resource leaks.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a fix for this vulnerability is available in the Linux Kernel version v5.16.20. By updating to this version or a later one, the missing pm_runtime_put_sync function call will be added, resolving the vulnerability.
As of now, there are no known exploits for this vulnerability. However, it is important to address it promptly to mitigate any potential risks.
This vulnerability was discovered by an automated vulnerability scanning tool and reported in the GSD-2022-1001409 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.