Use-after-free vulnerability in spi package
Summary
GSD-2021-1000285: spi: Fix use-after-free with devm_spi_alloc_*. Affects Kernel versions >= 5e844cc37a5cbaa460e68f9a989d321d63088a89, < 8735248ebb918d25427965f0db07939ed0473ec6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi package is a component of the Linux Kernel, which is responsible for managing Serial Peripheral Interface (SPI) devices. SPI is a synchronous serial communication interface commonly used for connecting microcontrollers, sensors, and other peripheral devices to a central processing unit (CPU). It allows for full-duplex communication between the master (CPU) and multiple slave devices. The spi package provides the necessary functionality and drivers for SPI communication in the Linux Kernel.
Vulnerability Detail
The vulnerability identified in the spi package is a use-after-free issue that occurs when using the devm_spi_alloc_* functions. This vulnerability was introduced in version v5.10 of the Linux Kernel by commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 and is fixed in version v5.12.4 by commit 8735248ebb918d25427965f0db07939ed0473ec6. A use-after-free vulnerability arises when a program continues to use a pointer after the memory it points to has been freed, leading to potential memory corruption and arbitrary code execution. Exploiting this vulnerability could allow an attacker to gain unauthorized access, escalate privileges, or cause a denial-of-service (DoS) condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the latest version.
Conclusion
The use-after-free vulnerability in the spi package of the Linux Kernel can be mitigated by updating to version v5.12.4 or later. It is crucial to promptly apply this fix to prevent potential unauthorized access, privilege escalation, or denial-of-service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The spi package is a component of the Linux Kernel that provides functionality and drivers for Serial Peripheral Interface (SPI) communication.
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and arbitrary code execution.
Exploiting this vulnerability could allow an attacker to gain unauthorized access, escalate privileges, or cause a denial-of-service (DoS) condition.
The vulnerability was introduced in version v5.10 of the Linux Kernel and is fixed in version v5.12.4.
To update the Linux Kernel, pull the latest changes from the official Linux Kernel repository and recompile/install the Kernel on the affected system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
