Unconditional security_locked_down() call in perf/core
Summary
GSD-2021-1000155: perf/core: Fix unconditional security_locked_down() call. Affects Kernel versions >= b0c8fdc7fdb77586c3d1937050925b960743306e, < 4348d3b5027bc3ff6336368b6c60605d4ef8e1ce. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The perf/core component is a part of the Linux Kernel, which is responsible for performance monitoring and profiling. It provides tools and interfaces for collecting and analyzing performance data. The security_locked_down() function is used to check if the system is in a locked-down state, where certain security measures are enforced to restrict access to sensitive resources. However, there is an issue with an unconditional call to this function, which can lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability arises from an unconditional call to the security_locked_down() function in the perf/core component of the Linux Kernel. This means that the function is called without any condition or check, which can bypass the intended security measures. An attacker can potentially exploit this vulnerability to gain unauthorized access to sensitive resources or perform malicious actions. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the perf/core component of the Linux Kernel, which involves an unconditional call to the security_locked_down() function, can potentially lead to security issues. It is crucial to update the Linux Kernel to version v5.10.35 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The perf/core component is a part of the Linux Kernel that handles performance monitoring and profiling. It provides tools and interfaces for collecting and analyzing performance data.
The security_locked_down() function is used to check if the system is in a locked-down state, where certain security measures are enforced to restrict access to sensitive resources.
The impact of this vulnerability is not yet proven. However, it can potentially allow unauthorized access to sensitive resources or enable malicious actions.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.35 or later.
You can find more information about this vulnerability in the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
