net: hns3: put off calling register_netdev() until client initialize complete
Summary
GSD-2021-1000532: net: hns3: put off calling register_netdev() until client initialize complete. Affects Kernel versions >= 08a100689d4baf296d6898c687ea8d005da8d234, < 0921a0620b5077796fddffb22a8e6bc635a4bb50. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package in the Linux Kernel is responsible for managing network devices and protocols. It provides the necessary infrastructure for networking operations. The hns3 driver is used for Huawei HiSilicon Network Subsystem 3 (HNS3) Ethernet controllers. The hns3 driver allows the Linux Kernel to communicate with these controllers and handle network traffic. This vulnerability specifically affects the hns3 driver in the net package.
Vulnerability Detail
The vulnerability in the hns3 driver arises from the premature calling of register_netdev() before the client initialization is complete. This can lead to various issues, including potential security vulnerabilities. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.12.9 by commit 0921a0620b5077796fddffb22a8e6bc635a4bb50. However, it was introduced in version v5.6 by commit 08a100689d4baf296d6898c687ea8d005da8d234.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net package in the Linux Kernel, specifically the hns3 driver, is vulnerable to a security issue where register_netdev() is called prematurely. This vulnerability has been fixed in Linux Kernel version v5.12.9. Users are advised to update their kernel to the fixed version or wait for their Linux distribution to provide an updated package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net package in the Linux Kernel is responsible for managing network devices and protocols. It provides the necessary infrastructure for networking operations.
The hns3 driver is used for Huawei HiSilicon Network Subsystem 3 (HNS3) Ethernet controllers. It allows the Linux Kernel to communicate with these controllers and handle network traffic.
register_netdev() is a function in the Linux Kernel that registers a network device. It is called during the initialization process to make the device available for network operations.
The potential ramifications of this vulnerability include security vulnerabilities and potential issues with network device initialization.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
