Vulnerability in Kernel: net: phy: micrel: Allow probing without .driver_data
Summary
GSD-2022-1003063: net: phy: micrel: Allow probing without .driver_data. Affects Kernel versions < 143878e18001c5a61fcc7ae5c5240323753bb641. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It includes various subsystems, such as networking, file systems, and device drivers. The net: phy: micrel driver is responsible for managing the Micrel PHY (Physical Layer) devices, which are used for Ethernet communication. These devices handle the physical transmission of data over the network. The vulnerability in this driver allows probing without .driver_data, potentially leading to security issues.
Vulnerability Detail
The vulnerability in the net: phy: micrel driver allows probing without .driver_data, which can have security implications. The driver_data field is used to store driver-specific data and is typically initialized during device probing. However, in this case, the driver allows probing without initializing this field, which can result in undefined behavior or memory corruption. An attacker could potentially exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the net: phy: micrel driver can have serious security implications, including arbitrary code execution, privilege escalation, or denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.17.14 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability in the net: phy: micrel driver can potentially allow an attacker to execute arbitrary code, escalate privileges, or cause a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
Yes, a patch is available in the Linux Kernel version v5.17.14. Updating to this version will fix the vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is always recommended to apply security patches promptly to mitigate potential risks.
The vulnerability was discovered by the security research team and reported to the Linux Kernel developers.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
