Vulnerability in Kernel: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
Summary
GSD-2022-1002078: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init. Affects Kernel versions >= f88fc122cc34c2545dec9562eaab121494e401ef, < a3587259ae553e41d1ce8c7435351a5d6b299a11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides low-level access to the computer's hardware. It manages system resources, facilitates communication between hardware and software, and ensures the overall stability and security of the system. The mtd (Memory Technology Devices) subsystem within the Kernel handles flash memory devices, such as NAND flash chips. The atmel_nand_controller_init function in the atmel driver is responsible for initializing the Atmel NAND flash controller. However, a refcount issue has been identified in this function, which could lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability in the atmel_nand_controller_init function arises from a refcount issue. This issue could be exploited by an attacker to gain unauthorized access or execute arbitrary code on the system. The exact impact and attack vectors have not been proven yet. The vulnerability was introduced in version v4.12 of the Linux Kernel and has been fixed in version v5.10.110 by commit a3587259ae553e41d1ce8c7435351a5d6b299a11.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's atmel_nand_controller_init function poses a potential security risk, allowing unauthorized access or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.10.110 or later to fix this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, it could potentially allow an attacker to gain unauthorized access or execute arbitrary code on the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Yes, a patch has been released in version v5.10.110 of the Linux Kernel. It is recommended to update to this version or later to fix the vulnerability.
Unfortunately, no specific temporary measures or workarounds have been mentioned for this vulnerability. It is advisable to update the Kernel as soon as possible to mitigate the risk.
You can find more information about this vulnerability in the GSD-2022-1002078 JSON file available on the GitHub repository of the Cloud Security Alliance's GSD Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002078.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
