Use After Free Vulnerability in emac_mac_tx_buf_send
Summary
GSD-2021-1000419: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send. Affects Kernel versions >= b9b17debc69d27cd55e21ee51a5ba7fc50a426cf, < 55fcdd1258faaecca74b91b88cc0921f9edd775d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The emac/emac-mac package is a component of the Linux Kernel that provides support for Ethernet Media Access Control (MAC) drivers. It is responsible for managing the transmission and reception of data packets over Ethernet connections. The emac_mac_tx_buf_send function is a critical part of the package that handles the sending of data packets. However, a use after free vulnerability has been discovered in this function, which can lead to potential security issues.
Vulnerability Detail
The use after free vulnerability in emac_mac_tx_buf_send arises from a programming error in the emac/emac-mac package. Specifically, the function fails to properly handle memory deallocation, resulting in a situation where a pointer to freed memory is still being used. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service by manipulating the freed memory. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply patches or backports provided by the Linux Kernel community to fix the vulnerability in their current version. Alternatively, they can disable the affected functionality if it is not essential for their system.
Conclusion
In conclusion, a use after free vulnerability has been identified in the emac/emac-mac package of the Linux Kernel. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial of service. It is recommended to update to Linux Kernel version v5.4.119 or later to fix this issue. Users can also apply patches or backports provided by the Linux Kernel community as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will analyze and alert you in real-time.
Yes, a fix for this vulnerability is available in Linux Kernel version v5.4.119 or later. It is recommended to update to the latest version to address the issue.
Yes, users can apply patches or backports provided by the Linux Kernel community to fix the vulnerability in their current version. Alternatively, they can disable the affected functionality if it is not essential for their system.
This vulnerability was discovered by an automated ID intended to aid in the discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
