Vulnerability in Kernel Package: tpm: efi: Use local variable for calculating final log size
Summary
GSD-2021-1000105: tpm: efi: Use local variable for calculating final log size. Affects Kernel versions >= 166a2809d65b282272c474835ec22c882a39ca1b, < 3818b753277f5ca0c170bf5b98e0a5a225542fcb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functions and providing an interface between hardware and software. It includes various subsystems, such as the TPM (Trusted Platform Module) subsystem, which handles interactions with TPM hardware. The vulnerability in question affects the TPM EFI (Extensible Firmware Interface) module within the Kernel package.
Vulnerability Detail
The vulnerability arises from the improper calculation of the final log size in the TPM EFI module. By not utilizing a local variable for this calculation, an attacker could potentially manipulate the log size, leading to buffer overflows or other memory-related issues. Although the impact and attack plausibility have not been proven, this vulnerability could potentially allow an attacker to execute arbitrary code or disrupt the system's integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel package's TPM EFI module, which involves the improper calculation of the final log size, can be mitigated by updating the package to version v5.11.20 or later. This fix ensures the use of a local variable for the calculation, reducing the risk of buffer overflows and other memory-related issues. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a fundamental component of the Linux operating system, responsible for managing core functions and facilitating hardware-software interactions.
The TPM (Trusted Platform Module) subsystem is a component within the Kernel package that handles interactions with TPM hardware, providing security-related functionalities.
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to execute arbitrary code or disrupt the system's integrity.
To fix this vulnerability, update the Linux Kernel package to version v5.11.20 or later, which includes the necessary fix for the TPM EFI module.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
