Vulnerability in Kernel package: media: usb: go7007: s2250-board: fix leak in probe()
Summary
GSD-2022-1002262: media: usb: go7007: s2250-board: fix leak in probe(). Affects Kernel versions >= d3b2ccd9e307eae80b4b4eeb0ede46cb02212df2, < 14cd5a8e61c654828a1f1056d56f0b0a524d2c69. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system. The media subsystem within the Kernel handles various media-related operations, including USB devices. The go7007 driver is responsible for supporting the Go7007 USB video capture devices. The s2250-board module is a specific board implementation for the go7007 driver. This vulnerability affects the probe() function in the s2250-board module.
Vulnerability Detail
The probe() function in the s2250-board module of the go7007 driver in the Kernel package has a memory leak issue. This vulnerability could allow an attacker to cause a denial-of-service condition by continuously triggering the probe() function, leading to a depletion of system memory resources. The impact of this vulnerability may vary depending on the system's available memory and the frequency of the probe() function calls. It is important to note that the actual attack plausibility and impact have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Kernel package is vulnerable to a memory leak issue in the go7007 driver's s2250-board module. This vulnerability can potentially lead to a denial-of-service condition. To mitigate the risk, it is recommended to update the Kernel package to version v5.4.189 or later. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to a denial-of-service condition by depleting system memory resources. The severity of the impact depends on the available memory and the frequency of the probe() function calls.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a patch for this vulnerability is available in the Linux Kernel version v5.4.189. You should update your Kernel package to this version or later to fix the issue.
There are no known exploits for this vulnerability at the moment. However, it is recommended to apply the patch as soon as possible to mitigate any potential risks.
You can find more details about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. Here is the source link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002262.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
