clk: qcom: ipq8074: fix PCI-E clock oops in Kernel
Summary
GSD-2022-1002068: clk: qcom: ipq8074: fix PCI-E clock oops. Affects Kernel versions >= f0cfcf1ade201dcfd3365f231efc90e846fa46df, < 8b89c9e68a01a19a1dd689a42aa65d545e931899. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. The clk subsystem within the Kernel handles clock management for various devices, ensuring they operate at the correct frequencies. One such device is the Qualcomm IPQ8074, which is a system-on-chip commonly used in networking equipment. The IPQ8074 includes a PCI-Express (PCI-E) interface for connecting peripheral devices. However, a vulnerability has been discovered in the Kernel's clk subsystem that affects the IPQ8074's PCI-E clock, leading to potential system crashes or instability.
Vulnerability Detail
The vulnerability in the Kernel's clk subsystem specifically impacts the PCI-E clock of the Qualcomm IPQ8074. When certain operations involving the PCI-E interface are performed, it triggers an oops (a kernel panic) due to incorrect clock handling. This can result in system crashes or instability, potentially leading to denial-of-service or other security issues. The vulnerability was introduced in Linux Kernel version v5.9 by commit f0cfcf1ade201dcfd3365f231efc90e846fa46df and has been fixed in version v5.10.110 by commit 8b89c9e68a01a19a1dd689a42aa65d545e931899.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the vulnerability in the Kernel's clk subsystem affecting the PCI-E clock of the Qualcomm IPQ8074 can lead to system crashes or instability. It is crucial to update the Linux Kernel to version v5.10.110 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to system crashes or instability, potentially causing denial-of-service or other security issues.
The vulnerability specifically affects systems using the Qualcomm IPQ8074 system-on-chip with the PCI-Express interface.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Currently, there are no known workarounds for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
More details about the fix can be found in the Linux Kernel commit 8b89c9e68a01a19a1dd689a42aa65d545e931899.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
