Vulnerability in Kernel: mips_cdmm_phys_base Refcount Leak
Summary
GSD-2022-1001840: mips: cdmm: Fix refcount leak in mips_cdmm_phys_base. Affects Kernel versions >= 2121aa3e2312ccc1d6299154dc4f07a6ab8beee2, < 69155dc2e04777aa94207a73a8b10f12b8428a68. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities and services to ensure the proper functioning of the system. The mips_cdmm_phys_base module in the Kernel is specifically designed for MIPS architecture and handles physical memory management. It allows mapping of physical memory regions to virtual addresses. However, a vulnerability has been identified in the module, leading to a refcount leak in mips_cdmm_phys_base.
Vulnerability Detail
The vulnerability in mips_cdmm_phys_base module results in a refcount leak. This leak can potentially lead to memory corruption or exhaustion, impacting system stability and performance. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in version v5.9 of the Linux Kernel and has been fixed in version v5.15.33.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Linux Kernel, there is no specific workaround available. It is advised to update the Kernel to the latest version to mitigate the vulnerability.
Conclusion
The vulnerability in mips_cdmm_phys_base module of the Linux Kernel can lead to memory corruption, system instability, and potential privilege escalation. It is crucial to update the Kernel to version v5.15.33 or later to patch the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to memory corruption or exhaustion, potentially causing system instability and performance issues. It may also allow an attacker to execute arbitrary code with elevated privileges or trigger a denial-of-service (DoS) condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to patch the Kernel to the latest version to prevent any potential exploitation.
As the vulnerability has been fixed in the latest version of the Linux Kernel, updating to the latest version is the recommended approach. There are no known alternative mitigations available.
You can find more information about the vulnerability in the Linux Kernel's Git repository. The commit 69155dc2e04777aa94207a73a8b10f12b8428a68 specifically addresses this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
