Vulnerability in cpufreq: qcom-cpufreq-nvmem Package
Summary
GSD-2022-1001816: cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse. Affects Kernel versions >= a8811ec764f95a04ba82f6f457e28c5e9e36e36b, < 251aabcb0b0925cc63f595a1d6d6485feb3119dd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cpufreq: qcom-cpufreq-nvmem package is a component of the Linux Kernel ecosystem. It provides functionality related to CPU frequency scaling on Qualcomm platforms. This package is responsible for reading the PVS Valid fuse, which determines the performance level of the CPU. However, a vulnerability has been discovered in the package that affects the reading of this fuse.
Vulnerability Detail
The vulnerability in cpufreq: qcom-cpufreq-nvmem package involves an issue with reading the PVS Valid fuse. The specific origin of this vulnerability is a flaw introduced in version v5.7 of the Linux Kernel by commit a8811ec764f95a04ba82f6f457e28c5e9e36e36b. The impact and attack plausibility of this vulnerability have not yet been proven. However, if exploited, it could potentially lead to security breaches or unauthorized access to the CPU performance level. The vulnerability has been addressed in Linux Kernel version v5.15.33 by commit 251aabcb0b0925cc63f595a1d6d6485feb3119dd.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the cpufreq: qcom-cpufreq-nvmem package in the Linux Kernel is vulnerable to an issue with reading the PVS Valid fuse. It is recommended to update the Linux Kernel to version v5.15.33 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The cpufreq: qcom-cpufreq-nvmem package is a component of the Linux Kernel ecosystem that handles CPU frequency scaling on Qualcomm platforms.
The impact of this vulnerability is currently unknown, as the attack plausibility has not been proven. However, if exploited, it could potentially lead to security breaches or unauthorized access to the CPU performance level.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.33 or later. This can be done by pulling the latest changes from the official Linux Kernel repository.
No specific workaround has been mentioned for this vulnerability.
For more details about this vulnerability, you can refer to the source: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001816.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
