Vulnerability in pinctrl: nomadik package - Missing of_node_put() in nmk_pinctrl_probe
Summary
GSD-2022-1002429: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe. Affects Kernel versions >= 32e67eee670e1254ee5ab41e2f454680acb9c17c, < 0356d4b64a03d23daf99a2a29d7d7d91d6ec2ea8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pinctrl: nomadik package is a component of the Linux Kernel. It provides pin control functionality for the Nomadik platform. Pin control allows software to configure and control the behavior of hardware pins on a system. The pinctrl: nomadik package is responsible for managing pin control on Nomadik-based devices. This vulnerability specifically affects the nmk_pinctrl_probe function within the package.
Vulnerability Detail
The vulnerability in the pinctrl: nomadik package arises from a missing of_node_put() call in the nmk_pinctrl_probe function. This omission can lead to a reference count leak, potentially resulting in a use-after-free vulnerability. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v3.9 of the Linux Kernel and has been fixed in version v4.14.276.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided in the Linux Kernel version v4.14.276.
Conclusion
The pinctrl: nomadik package in the Linux Kernel is vulnerable to a use-after-free vulnerability due to a missing of_node_put() call in the nmk_pinctrl_probe function. This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is recommended to apply the fix provided in the Linux Kernel version v4.14.276 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on systems using the pinctrl: nomadik package.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is no known exploit for this vulnerability at this time. However, it is important to apply the fix provided in the Linux Kernel version v4.14.276 to mitigate any potential risk.
This vulnerability specifically affects the pinctrl: nomadik package in the Linux Kernel. There are no known dependencies or other packages directly impacted by this vulnerability.
You can find more information about this vulnerability in the GSD-2022-1002429 entry of the GSD Database maintained by the Cloud Security Alliance. The entry provides details on the vulnerability, including its introduction and fix commits in the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
