Unconditional security_locked_down() call in perf/core
Summary
GSD-2021-1000182: perf/core: Fix unconditional security_locked_down() call. Affects Kernel versions >= b0c8fdc7fdb77586c3d1937050925b960743306e, < b246759284d6a2bc5b6f1009caeeb3abce2ec9ff. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and processes. The perf/core module within the Kernel is responsible for performance monitoring and profiling. It allows users to gather detailed information about system performance and analyze it for optimization purposes.
Vulnerability Detail
The vulnerability in perf/core is related to an unconditional security_locked_down() call. This call is intended to enforce security measures when the system is in a locked-down state. However, due to a coding error, the call is made unconditionally, regardless of the system's actual state. This vulnerability could potentially allow an attacker to bypass security restrictions and gain unauthorized access to sensitive information or perform malicious actions on the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating the Kernel to the recommended version.
Conclusion
The vulnerability in perf/core related to the unconditional security_locked_down() call can potentially allow unauthorized access and malicious actions on the system. To mitigate this risk, it is crucial to update the Linux Kernel to version v5.4.117 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to bypass security restrictions and gain unauthorized access to sensitive information or perform malicious actions on the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the fix promptly to mitigate any potential risks.
Modifying the Kernel code manually is not recommended, as it can introduce further issues and may not be feasible for all users. It is best to update the Kernel to the latest stable version, which includes the official fix.
The recommended solution is to update the Kernel to the latest stable version. Alternative solutions may not provide the same level of security and may introduce compatibility or stability issues.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
