usbnet: Run unregister_netdev() before unbind() again
Summary
GSD-2022-1002789: usbnet: Run unregister_netdev() before unbind() again. Affects Kernel versions < 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The usbnet package is a part of the Linux Kernel ecosystem. It provides support for USB network devices, allowing them to be used as network interfaces in the Linux operating system. USB network devices are commonly used for connecting devices like smartphones, tablets, and network adapters to a computer. The usbnet package handles the initialization, configuration, and management of these USB network devices.
Vulnerability Detail
The vulnerability identified in the usbnet package involves the improper order of operations during the unbinding process. Specifically, the unregister_netdev() function is not called before the unbind() function is invoked again. This can lead to a potential security vulnerability, although the exact impact and attack plausibility have not been proven. The vulnerability has been addressed in the Linux Kernel version v5.18.3 by commit 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.18.3 or later. This can be done by following the official update process provided by the Linux distribution being used. Alternatively, users can manually apply the commit 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509 to their Linux Kernel source code and rebuild the kernel.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The usbnet package in the Linux Kernel is vulnerable to a potential security issue related to the unbinding process. It is recommended to update the Linux Kernel to version v5.18.3 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
usbnet is a package in the Linux Kernel ecosystem that provides support for USB network devices.
The exact impact and attack plausibility of this vulnerability have not been proven. However, it is important to apply the fix to ensure the security of USB network devices.
To fix this vulnerability, update the Linux Kernel to version v5.18.3 or later.
Yes, users can manually apply the commit 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509 to their Linux Kernel source code and rebuild the kernel.
For more details about this vulnerability, refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.