Vulnerability in Kernel package: gpiolib: acpi: use correct format characters
Summary
GSD-2022-1001961: gpiolib: acpi: use correct format characters. Affects Kernel versions >= e40a3ae1f794a35c4af3746291ed6fedc1fa0f6f, < 9709c8b5cdc88b1adb77acdbfd6e8a3f942d9af5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The gpiolib subsystem within the Kernel package handles interactions with General Purpose Input/Output (GPIO) pins. GPIO pins are used to control and monitor external devices connected to the system, such as sensors, buttons, and LEDs. This vulnerability specifically affects the ACPI (Advanced Configuration and Power Interface) component of gpiolib.
Vulnerability Detail
The vulnerability in the gpiolib ACPI component arises from the incorrect usage of format characters. Format characters are placeholders used in formatted input/output operations to specify the type and format of data being processed. In this case, incorrect format characters are used, which can lead to various security issues, including potential memory corruption, information disclosure, or denial of service. Exploiting this vulnerability may allow an attacker to execute arbitrary code or crash the system. The vulnerability was introduced in version v4.14 of the Linux Kernel and has been fixed in version v5.10.112.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel package is not immediately feasible, a possible workaround is to disable the affected ACPI functionality. This can be achieved by modifying the system's ACPI configuration or disabling ACPI support altogether. However, this workaround may result in the loss of certain ACPI-related features and functionality. It is recommended to consult the official documentation or seek assistance from the Linux distribution's support channels for guidance on implementing this workaround.
Conclusion
The vulnerability in the gpiolib ACPI component of the Kernel package poses a significant risk, potentially allowing attackers to execute arbitrary code or crash the system. It is crucial to update the Kernel package to version v5.10.112 or later to mitigate this vulnerability. If immediate updating is not possible, consider disabling the affected ACPI functionality as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Exploiting this vulnerability may allow an attacker to execute arbitrary code or crash the system. It could potentially lead to memory corruption, information disclosure, or denial of service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time and provide alerts for any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability has been released in version v5.10.112 of the Linux Kernel. It is recommended to update to this version or a later one to fix the vulnerability.
While updating the Kernel package is the recommended solution, if immediate updating is not possible, you can consider disabling the affected ACPI functionality as a temporary workaround. However, this may result in the loss of certain ACPI-related features and functionality.
You can find more information about this vulnerability, including the specific commits that introduced and fixed it, in the vulnerability database maintained by the Cloud Security Alliance. The source link is provided in the database-specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
