net: hso: fix NULL-deref on disconnect regression
Summary
GSD-2021-1000128: net: hso: fix NULL-deref on disconnect regression. Affects Kernel versions >= 388d05f70f1ee0cac4a2068fd295072f1a44152a, < 0f000005da31f6947f843ce6b3e3a960540c6e00. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package in the Linux Kernel is responsible for handling network-related functionality. It provides the necessary infrastructure for network communication, including protocols, drivers, and utilities. The hso module within the net package is specifically designed for High-Speed Option (HSO) devices, which are used for mobile broadband communication. These devices connect to the system via USB and provide network connectivity. However, a vulnerability has been discovered in the hso module that can lead to a NULL-dereference on disconnect, potentially causing a system crash or other adverse effects.
Vulnerability Detail
The vulnerability in the hso module occurs when a disconnect event is triggered. Due to a programming error, the module fails to handle this event properly, resulting in a NULL-dereference. An attacker could potentially exploit this vulnerability by sending specially crafted network packets or by manipulating the device's connection state. This could lead to a denial-of-service (DoS) attack, system instability, or even remote code execution. The vulnerability was introduced in version v5.11.14 of the Linux Kernel and has been fixed in version v5.11.17.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the hso module or remove any HSO devices from the system. This can be done by blacklisting the hso module or physically disconnecting the HSO devices. However, it is important to note that this workaround may result in the loss of mobile broadband connectivity.
Conclusion
The net package in the Linux Kernel, specifically the hso module, is vulnerable to a NULL-dereference on disconnect. This vulnerability can have serious consequences, including system crashes, denial-of-service attacks, and potential remote code execution. It is crucial to update the Linux Kernel to version v5.11.17 or later to mitigate this vulnerability. If immediate updating is not possible, disabling the hso module or removing HSO devices can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a NULL-dereference on disconnect in the hso module, potentially causing a system crash or other adverse effects. It could also be exploited by attackers to perform denial-of-service attacks or execute arbitrary code.
You can check if your system is affected by this vulnerability by examining the version of the Linux Kernel installed. If your system is running version v5.11.14 or earlier, it is likely vulnerable. You can also use tools like Vulert to scan your system for known vulnerabilities.
Yes, a patch has been released in version v5.11.17 of the Linux Kernel. It is recommended to update to this version or later to mitigate the vulnerability.
If updating the kernel is not immediately feasible, you can consider disabling the hso module or removing HSO devices from the system as a temporary workaround. However, this may result in the loss of mobile broadband connectivity.
You can find more information about this vulnerability in the Linux Kernel documentation and the official Linux Kernel repository. Additionally, you can refer to the vulnerability database maintained by the Cloud Security Alliance for specific details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
