Vulnerability in pinctrl: samsung package
Summary
GSD-2022-1001926: pinctrl: samsung: drop pin banks references on error paths. Affects Kernel versions >= ab663789d69760d2735402f66501f20b60312a3d, < 89d369454267123bc2986a3bb49b7eaef6de2d7e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pinctrl: samsung package is a component of the Linux Kernel that provides pin control functionality for Samsung devices. It allows for the configuration and management of pin banks, which are used to control the behavior of input/output pins on the device. This package is widely used in Samsung devices running the Linux operating system.
Vulnerability Detail
The vulnerability in the pinctrl: samsung package involves the improper handling of pin bank references on error paths. When an error occurs during the configuration or management of pin banks, the package fails to properly release the associated references, leading to a resource leak. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to apply the fix mentioned above by updating the Linux Kernel to the latest version.
Conclusion
The vulnerability in the pinctrl: samsung package can lead to a denial-of-service condition or potential execution of arbitrary code with elevated privileges. It is crucial to update the Linux Kernel to version v5.15.33 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service condition or potential execution of arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
The vulnerability was introduced in version v3.8 of the Linux Kernel and is fixed in version v5.15.33. Therefore, versions between v3.8 and v5.15.33 are affected.
There is no known exploit for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to prevent any potential exploitation.
You can find more information about this vulnerability in the GSD-2022-1001926 JSON file available on the GitHub repository of the Cloud Security Alliance's GSD Database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
