Missing Free in wm8350-power Charger IRQ
Summary
GSD-2022-1002087: power: supply: wm8350-power: Add missing free in free_charger_irq. Affects Kernel versions >= 14431aa0c5a443d13d24e6f865a8838f97dab973, < 48d23ef90116c8c702bfa4cad93744e4e5588d7d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wm8350-power supply module is part of the Linux Kernel, which is responsible for managing power supply devices on systems that use the WM8350 power management IC. This module provides support for controlling and monitoring battery charging, voltage regulation, and other power-related functions. The vulnerability in question involves a missing 'free' operation in the 'free_charger_irq' function of the wm8350-power module.
Vulnerability Detail
The missing 'free' operation in the 'free_charger_irq' function can lead to a resource leak, where allocated memory is not properly released. This vulnerability can potentially be exploited by an attacker to exhaust system resources, resulting in a denial-of-service condition. The impact of this vulnerability may vary depending on the specific usage scenario and the availability of other mitigations. It is important to note that the actual attack plausibility and impact have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually modify the affected code by adding the missing 'free' operation in the 'free_charger_irq' function. The following code snippet demonstrates the necessary modification:
static void free_charger_irq(struct wm8350 *wm8350)
{
// Existing code
...
// Add missing 'free' operation
kfree(wm8350->charger_irq);
}
Conclusion
The missing 'free' operation in the 'free_charger_irq' function of the wm8350-power supply module can lead to a resource leak and potential denial-of-service conditions. It is recommended to update the Linux Kernel to version v5.10.110 or later to fix this vulnerability. Alternatively, users can apply the provided workaround by manually adding the missing 'free' operation in the code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The wm8350-power supply module is a component of the Linux Kernel that handles power supply management for systems utilizing the WM8350 power management IC. It provides functionality for controlling battery charging, voltage regulation, and other power-related tasks.
The missing 'free' operation can result in a resource leak, where allocated memory is not properly released. This can potentially lead to resource exhaustion and a denial-of-service condition.
The vulnerability can potentially be exploited by an attacker to exhaust system resources, causing a denial-of-service condition. However, the actual attack plausibility and impact have not been proven.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.110 or later. This update includes the necessary fix for the missing 'free' operation.
Yes, a workaround involves manually adding the missing 'free' operation in the 'free_charger_irq' function. The provided code snippet demonstrates the necessary modification.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
