Vulnerability in Kernel package: serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
Summary
UVI-2021-1000660: serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'. Affects Kernel versions < 35265552c7fe9553c75e324c80f45e28ff14eb6e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. The serial subsystem within the Kernel package handles communication with serial devices. One specific module, rp2, is responsible for managing the Raspberry Pi 2 serial interface. This vulnerability affects the rp2 module and its usage of the 'request_firmware_nowait' function.
Vulnerability Detail
The vulnerability arises from the use of the 'request_firmware_nowait' function in the rp2 module. This function allows asynchronous firmware loading, which can lead to potential security issues. Attackers may exploit this vulnerability to execute arbitrary code or trigger a denial-of-service condition. The vulnerability was addressed in Linux Kernel version v4.19.193 by replacing the 'request_firmware_nowait' function with the safer 'request_firmware' function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from using the rp2 module or by disabling the serial functionality altogether. However, this may not be feasible in scenarios where serial communication is essential.
Conclusion
The vulnerability in the Kernel package's rp2 module has been addressed in Linux Kernel version v4.19.193. It is crucial to update the Kernel package to this version or later to ensure the security and stability of your system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially allow attackers to execute arbitrary code or cause a denial-of-service condition.
If the rp2 module is not loaded or used in your system, the vulnerability does not directly affect you. However, it is still recommended to update the Kernel package to ensure overall system security.
While it is technically possible to patch the vulnerability manually, it is not recommended unless you have extensive knowledge of the Kernel codebase. Updating the Kernel package to the latest version is the recommended approach.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended updates to mitigate any potential risks.
You can refer to the official documentation of your Linux distribution or the Linux Kernel website for detailed instructions on updating the Kernel package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
