Use After Free Vulnerability in habanalabs/gaudi
Summary
GSD-2021-1000504: habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory. Affects Kernel versions >= 423815bf02e257091d5337be5c63b57fc29e4254, < b49f5af30b0e4064fbd91e83823a4bfcb2c7a3e7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The habanalabs/gaudi package is a component of the Linux Kernel ecosystem. It provides functionality for the Gaudi AI accelerator. The Gaudi AI accelerator is used for machine learning and artificial intelligence tasks. This vulnerability affects versions of the Linux Kernel starting from v5.12, introduced by commit 423815bf02e257091d5337be5c63b57fc29e4254. It was fixed in version v5.12.7 by commit b49f5af30b0e4064fbd91e83823a4bfcb2c7a3e7.
Vulnerability Detail
The vulnerability in habanalabs/gaudi is a potential use after free issue in the gaudi_memset_device_memory function. Although the impact and attack plausibility have not been proven, this vulnerability could potentially be exploited by an attacker. The use after free vulnerability occurs when a program continues to use a memory address after it has been freed, leading to unpredictable behavior and potential security risks. This vulnerability could potentially be leveraged to execute arbitrary code or cause a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the habanalabs/gaudi package in the Linux Kernel is affected by a use after free vulnerability. It is recommended to update to version v5.12.7 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
habanalabs/gaudi is a component of the Linux Kernel ecosystem that provides functionality for the Gaudi AI accelerator.
A use after free vulnerability occurs when a program continues to use a memory address after it has been freed, leading to unpredictable behavior and potential security risks.
The impact of this vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.12.7 or later.
Users can obtain the updated version of the Linux Kernel from the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
