Missing of_node_put() in nmk_pinctrl_probe in Kernel
Summary
GSD-2022-1001814: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe. Affects Kernel versions >= 32e67eee670e1254ee5ab41e2f454680acb9c17c, < c52703355766c347f270df222a744e0c491a02f2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The pinctrl subsystem in the Kernel allows for the configuration and control of pin multiplexing and GPIOs on various platforms. The nomadik pinctrl driver is responsible for managing pin control on Nomadik platforms. However, a vulnerability has been identified in the nmk_pinctrl_probe function, where a call to of_node_put() is missing, leading to a reference count leak. This vulnerability can potentially be exploited by an attacker to cause a denial-of-service condition or escalate privileges.
Vulnerability Detail
The missing of_node_put() call in the nmk_pinctrl_probe function can result in a reference count leak. This vulnerability allows an attacker to repeatedly trigger the probe function, leading to a gradual depletion of system resources. In a worst-case scenario, this can result in a denial-of-service condition, rendering the affected system unresponsive. Additionally, if the attacker has sufficient privileges, they may be able to leverage this vulnerability to escalate their privileges and gain unauthorized access to sensitive information or perform unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually apply the patch provided in the fix commit to the affected Kernel version. The patch adds the missing of_node_put() call in the nmk_pinctrl_probe function. Here is the code snippet for the patch:
--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
@@ -123,6 +123,7 @@ static int nmk_pinctrl_probe(struct platform_device *pdev)
return -ENOMEM;
ret = of_property_read_u32(np, "reg", &base);
+ of_node_put(np);
if (ret) {
dev_err(&pdev->dev, "failed to get base address\n");
return ret;
Conclusion
The missing of_node_put() call in the nmk_pinctrl_probe function in the Kernel can lead to a reference count leak, potentially resulting in a denial-of-service condition or privilege escalation. It is crucial to update to Linux Kernel version v5.15.33 or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service condition or privilege escalation. An attacker can deplete system resources or gain unauthorized access to sensitive information.
To fix this vulnerability, update to Linux Kernel version v5.15.33 or a later version. Alternatively, apply the provided patch manually to the affected Kernel version.
Yes, a workaround is available. Users can apply the provided patch manually to the affected Kernel version to mitigate the vulnerability.
The vulnerability itself does not provide remote exploitation capabilities. However, if an attacker already has access to the system, they can leverage this vulnerability to escalate privileges or cause a denial-of-service condition.
Yes, this vulnerability has been fixed in Linux Kernel version v5.15.33 by commit c52703355766c347f270df222a744e0c491a02f2.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
