Vulnerability in Kernel package: iommu/mediatek: Always enable the clk on resume
Summary
UVI-2021-1000239: iommu/mediatek: Always enable the clk on resume. Affects Kernel versions >= c0b57581b73be7b43f39e0dff201c93413f6a668, < 5cad9e2caa9613fdcd246bd4ebf0ffbec1cba2ca. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's resources and providing an interface between hardware and software. It includes various subsystems, one of which is the iommu/mediatek module. This module handles input-output memory management unit (IOMMU) operations for MediaTek devices. The IOMMU is responsible for mapping virtual addresses to physical addresses, ensuring secure and efficient data transfers between devices and memory. However, a vulnerability has been discovered in the iommu/mediatek module, which can have potential security implications.
Vulnerability Detail
The vulnerability in the iommu/mediatek module arises from a flaw in the handling of clock (clk) operations during system resume. The module fails to enable the clk on resume, which can lead to various issues, including incorrect device behavior, system instability, and potential security vulnerabilities. An attacker may exploit this vulnerability to manipulate the device's behavior, gain unauthorized access, or launch other malicious activities. The vulnerability was introduced in version v5.12 of the Linux Kernel and is fixed in version v5.12.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the iommu/mediatek module of the Kernel package can lead to incorrect device behavior, system instability, and potential security risks. It is crucial to update the Linux Kernel to version v5.12.4 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in incorrect device behavior, system instability, and potential security risks. Attackers may exploit this vulnerability to gain unauthorized access or manipulate the device's behavior.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, a patch is available in the Linux Kernel version v5.12.4. It is recommended to update your Kernel to this version or later to mitigate the vulnerability.
At the time of this report, no known exploits for this vulnerability have been reported. However, it is crucial to apply the patch and keep the system up to date to prevent any potential exploitation.
You can find more information about this vulnerability, including the commit details and affected versions, in the vulnerability database maintained by the Cloud Security Alliance: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000239.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
