GCC 12 Array-Bounds Warning in eth: tg3
Summary
GSD-2022-1003986: eth: tg3: silence the GCC 12 array-bounds warning. Affects Kernel versions < d5ef9f9b979d86adebca130f5c1dbd9ced3920b8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The eth: tg3 vulnerability affects the Kernel package in the Linux ecosystem. The Kernel package is a critical component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. The tg3 driver within the Kernel package is specifically used for Broadcom Tigon3 Ethernet devices. This vulnerability relates to a GCC 12 array-bounds warning in the tg3 driver code.
Vulnerability Detail
The vulnerability arises from a GCC 12 array-bounds warning in the tg3 driver code. The warning indicates a potential out-of-bounds access to an array, which could lead to memory corruption or other security issues. While the impact and attack plausibility have not been proven, it is crucial to address this warning to mitigate any potential risks. The vulnerability has been fixed in Linux Kernel version v4.14.283 by commit d5ef9f9b979d86adebca130f5c1dbd9ced3920b8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The GCC 12 array-bounds warning in the eth: tg3 driver code of the Kernel package poses a potential security risk. It is recommended to update the Kernel package to version v4.14.283 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software.
The tg3 driver is a specific driver within the Kernel package used for Broadcom Tigon3 Ethernet devices.
A GCC 12 array-bounds warning is a warning generated by the GCC compiler indicating a potential out-of-bounds access to an array in the code.
The potential risks of this vulnerability include memory corruption and other security issues that could be exploited by attackers.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you in real-time for any open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
