Vulnerability in Kernel: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
Summary
GSD-2022-1002433: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init. Affects Kernel versions >= f88fc122cc34c2545dec9562eaab121494e401ef, < 0856bf27057561f42b37df111603cf5a0d040294. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The mtd (Memory Technology Devices) subsystem within the Kernel handles flash memory devices, such as NAND flash chips. The Atmel NAND controller driver is responsible for managing NAND flash devices manufactured by Atmel. This vulnerability specifically affects the atmel_nand_controller_init function within the driver.
Vulnerability Detail
The atmel_nand_controller_init function in the Atmel NAND controller driver in the Kernel suffers from a refcount issue. This issue can potentially lead to a use-after-free vulnerability, where a reference to an object is used after it has been freed from memory. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v4.12 of the Kernel and has been fixed in version v4.14.276.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Kernel to the fixed version as soon as possible.
Conclusion
The vulnerability in the Kernel's Atmel NAND controller driver can lead to a use-after-free issue, potentially enabling arbitrary code execution or causing a denial-of-service condition. It is crucial to update the Kernel to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on a system running the affected version of the Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
At the time of writing, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the affected system is exposed to the internet and the necessary conditions are met.
For more details about this vulnerability, you can refer to the source link in the Cloud Security Alliance's GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002433.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
