Vulnerability in Kernel: arm_smmu_device refcount leak in address translation
Summary
UVI-2021-1001273: iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation. Affects Kernel versions < 43d1aaa1965f9b58035196dac49b1e1e6c9c25eb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The arm-smmu module within the Kernel is responsible for handling address translation for ARM System MMUs (SMMUs), which are used to manage input/output memory management units in ARM-based systems. This vulnerability in the arm-smmu module can lead to a refcount leak in address translation.
Vulnerability Detail
The vulnerability in the arm-smmu module of the Kernel results in a refcount leak during address translation. This can potentially lead to resource exhaustion and impact the stability and performance of the system. An attacker may be able to exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code with elevated privileges. The vulnerability has been assigned the ID UVI-2021-1001273 and has been fixed in Linux Kernel version v5.10.52 by commit 43d1aaa1965f9b58035196dac49b1e1e6c9c25eb.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the arm-smmu module of the Kernel can lead to a refcount leak in address translation, potentially resulting in resource exhaustion and unauthorized code execution. It is crucial to update the Linux Kernel to version v5.10.52 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource exhaustion and potentially allow an attacker to execute arbitrary code with elevated privileges.
Yes, this vulnerability has been fixed in Linux Kernel version v5.10.52 by commit 43d1aaa1965f9b58035196dac49b1e1e6c9c25eb.
To update the Linux Kernel, you can fetch the latest version from the official Git repository and apply the necessary patches. Detailed instructions can be found in the official documentation.
The exact attack vector and exploitability of this vulnerability have not been determined. It is recommended to update the Kernel to the fixed version as a precautionary measure.
You can find more information about this vulnerability in the source database of the Cloud Security Alliance's GSD project. The specific vulnerability ID is UVI-2021-1001273.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
