Vulnerability in Kernel: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
Summary
UVI-2021-1000356: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails. Affects Kernel versions >= 93222bd9b966105f43418fd336654ad10045783a, < e80ae8bde41266d3b8bf012460b6593851766006. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The i2c subsystem in the Kernel is responsible for handling communication with I2C devices, which are commonly used for interconnecting various components in embedded systems. One specific module within the i2c subsystem is img-scb, which is used for managing the Synopsys DesignWare I2C controller. This vulnerability in the img-scb module can lead to a reference leak when the pm_runtime_get_sync function fails.
Vulnerability Detail
The vulnerability arises due to a reference leak in the img-scb module when the pm_runtime_get_sync function fails. This reference leak can result in the improper handling of resources, leading to potential security issues. An attacker may be able to exploit this vulnerability to gain unauthorized access, escalate privileges, or cause a denial-of-service condition. The vulnerability was introduced in Kernel version v4.15 by commit 93222bd9b966105f43418fd336654ad10045783a and is fixed in version v5.10.37 by commit e80ae8bde41266d3b8bf012460b6593851766006.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's i2c img-scb module can lead to a reference leak when the pm_runtime_get_sync function fails. It is crucial to update the Kernel to version v5.10.37 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially be exploited by attackers to gain unauthorized access, escalate privileges, or cause a denial-of-service condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch is available for this vulnerability in Kernel version v5.10.37. It is recommended to update to this version or later to fix the vulnerability.
Updating the Kernel to the fixed version is the recommended approach to mitigate the risk. However, if updating is not immediately feasible, you can consider implementing additional security measures such as restricting access to vulnerable systems, implementing network-level protections, and monitoring for any suspicious activity.
You can find more information about this vulnerability in the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the vulnerability database maintained by the Cloud Security Alliance (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000356.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
