Vulnerability in Kernel package: video: fbdev: sm712fb: Fix crash in smtcfb_write()
Summary
GSD-2022-1002214: video: fbdev: sm712fb: Fix crash in smtcfb_write(). Affects Kernel versions < 3b36c05f68ba32d0dfb63abc9016d6fe9117829f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices and software components. The video subsystem within the Kernel package handles video-related operations, including framebuffer devices (fbdev). The sm712fb driver is responsible for supporting the Silicon Motion LynxEM+ SM712 graphics controller. This vulnerability specifically affects the sm712fb driver's smtcfb_write() function.
Vulnerability Detail
The smtcfb_write() function in the sm712fb driver within the Kernel package is vulnerable to a crash. The exact cause and impact of the crash have not been determined yet. However, it is important to note that crashes can potentially lead to system instability, denial of service, or even remote code execution if an attacker can exploit the crash. The vulnerability has been fixed in Linux Kernel version v5.4.189 by commit 3b36c05f68ba32d0dfb63abc9016d6fe9117829f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by updating the Kernel package to the recommended version.
Conclusion
The vulnerability in the Kernel package's sm712fb driver has the potential to cause crashes and system instability. It is crucial to update the Kernel package to version v5.4.189 or later to fix this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown. However, crashes can potentially lead to system instability, denial of service, or remote code execution if exploited.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch has been released in Linux Kernel version v5.4.189. It is recommended to update the Kernel package to this version or later.
If an attacker can exploit the crash caused by this vulnerability, remote code execution may be possible. However, the exact attack vectors and feasibility have not been determined yet.
There are no known instances of this vulnerability being exploited at the moment. However, it is always recommended to apply security patches and updates to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
