Use-after-free vulnerability in spi package
Summary
GSD-2021-1000457: spi: Fix use-after-free with devm_spi_alloc_*. Affects Kernel versions >= 234b432c7b6184b2d6c5ba2c55f0dd5023c0edf0, < 28a5529068c51cdf0295ab1e11a99a3a909a03e4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The spi package is a component of the Linux Kernel, which is responsible for managing Serial Peripheral Interface (SPI) devices. SPI is a synchronous serial communication interface commonly used for connecting microcontrollers, sensors, and other peripheral devices to a central processing unit (CPU). The spi package provides the necessary functionality and drivers for SPI communication in the Linux Kernel.
Vulnerability Detail
The use-after-free vulnerability in the spi package occurs when the devm_spi_alloc_* functions are used. These functions allocate memory for SPI devices and register them with the SPI subsystem. However, due to a programming error, the memory allocated by these functions is not properly freed when the devices are released. This can lead to a situation where the memory is accessed after it has been freed, potentially resulting in a crash or arbitrary code execution. The vulnerability was introduced in version v4.19.163 of the Linux Kernel and is fixed in version v4.19.191.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
The use-after-free vulnerability in the spi package of the Linux Kernel can be a serious security issue, potentially leading to system crashes or arbitrary code execution. It is crucial to update the Linux Kernel to version v4.19.191 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including crashes, memory corruption, and arbitrary code execution.
Exploiting the use-after-free vulnerability in the spi package would require an attacker to have the ability to execute arbitrary code on a system with a vulnerable version of the Linux Kernel. This could be achieved through other vulnerabilities or by gaining unauthorized access to the system.
The use-after-free vulnerability in the spi package could allow an attacker to crash the system or execute arbitrary code with kernel-level privileges. This could lead to a complete compromise of the affected system and the unauthorized access, modification, or theft of sensitive information.
There is no information available regarding the exploitation of this vulnerability in the wild at the time of this report.
For more information about this vulnerability, including technical details and the fix, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
