ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
Summary
GSD-2021-1000416: ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook. Affects Kernel versions >= 1879445dfa7bbd6fe21b09c5cc72f4934798afed, < 3ed8832aeaa9a37b0fc386bb72ff604352567c80. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware and software components. The hw_breakpoint module within the Kernel is responsible for handling hardware breakpoints, which allow developers to set breakpoints in code execution for debugging purposes. This vulnerability affects the hw_breakpoint module in ARM architecture.
Vulnerability Detail
The vulnerability arises from a flaw in the hw_breakpoint module's handling of the event's overflow_handler hook. By directly checking this hook, an attacker may be able to exploit the system and execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.4.120 by commit 3ed8832aeaa9a37b0fc386bb72ff604352567c80. However, it was introduced in version v4.7 by commit 1879445dfa7bbd6fe21b09c5cc72f4934798afed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The ARM: 9064/1: hw_breakpoint vulnerability in the Kernel package poses a potential security risk. It is recommended to update the Linux Kernel to version v5.4.120 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, an attacker may be able to execute arbitrary code on the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in Linux Kernel version v5.4.120 or later. It is recommended to update the Kernel to the latest version to mitigate the risk.
No, updating the Kernel to the fixed version is the recommended approach to fix this vulnerability. Manually modifying the code or applying workarounds may introduce other issues or not fully address the vulnerability.
You can refer to the vulnerability details in the GSD Database at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000416.json for more information about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
