ACPI: custom_method: Fix Potential Use-After-Free Issue in Linux Kernel
Summary
GSD-2021-1000081: ACPI: custom_method: fix potential use-after-free issue. Affects Kernel versions >= 03d1571d9513369c17e6848476763ebbd10ec2cb, < b7a5baaae212a686ceb812c32fceed79c03c0234. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for software to interact with the hardware. ACPI (Advanced Configuration and Power Interface) is a standard that defines hardware and software interfaces for power management and configuration. The ACPI custom_method feature allows system-specific methods to be executed by user-space applications. However, a potential use-after-free issue has been identified in the ACPI custom_method implementation, which could lead to security vulnerabilities.
Vulnerability Detail
The vulnerability in the ACPI custom_method implementation arises from a use-after-free issue. This occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption or arbitrary code execution. An attacker could exploit this vulnerability to gain unauthorized access, escalate privileges, or cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version 5.4 and has been fixed in version 5.12.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the ACPI custom_method feature if it is not required for their system. This can be done by modifying the kernel configuration and rebuilding the kernel without the ACPI custom_method support. However, this workaround may not be feasible for all systems, especially those that rely on the functionality provided by the ACPI custom_method feature.
Conclusion
The ACPI custom_method vulnerability in the Linux Kernel can pose significant security risks, potentially allowing unauthorized access, privilege escalation, or denial-of-service attacks. It is crucial to update the kernel to version 5.12.3 or later to fix the vulnerability. Users can also utilize the Vulert Playground (https://vulert.com/scanner) to check if their system is affected and receive real-time alerts for open-source vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to gain unauthorized access, escalate privileges, or cause a denial-of-service condition on systems running the affected Linux Kernel versions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for open-source vulnerabilities, including this specific issue.
Yes, the vulnerability has been fixed in Linux Kernel version 5.12.3. It is recommended to update to this version or a later one to mitigate the risk.
As a temporary measure, you can disable the ACPI custom_method feature if it is not required for your system. However, this may not be feasible for all systems and it is still recommended to update the kernel as soon as possible.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is always important to promptly apply security updates to mitigate the risk of potential exploits.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
