Duplicate active_bo vulnerability in media: atomisp package
Summary
GSD-2022-1002041: media: atomisp: fix dummy_ptr check to avoid duplicate active_bo. Affects Kernel versions < 41082d6432e5d8cfaaa49a3864c88a16535f8e95. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The media: atomisp package is a component of the Linux Kernel, which is responsible for handling media-related functionalities. It includes support for the Intel Atom Image Signal Processor (ISP) driver. The Atom ISP driver enables image and video processing capabilities on Intel Atom processors. This vulnerability specifically affects the dummy_ptr check in the atomisp module.
Vulnerability Detail
The vulnerability in the media: atomisp package allows for the occurrence of duplicate active_bo. This issue arises due to a flaw in the dummy_ptr check. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The duplicate active_bo vulnerability in the media: atomisp package of the Linux Kernel can potentially lead to a denial-of-service (DoS) condition or arbitrary code execution. It is crucial to update the Kernel to version v5.10.110 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a denial-of-service (DoS) condition to the execution of arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
As of now, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to prevent any potential exploitation.
No, updating the Kernel to the recommended version is the only known solution to mitigate this vulnerability.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry GSD-2022-1002041 (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002041.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
