net: zero-initialize tc skb extension on allocation
Summary
GSD-2021-1000575: net: zero-initialize tc skb extension on allocation. Affects Kernel versions >= 038ebb1a713d114d54dbf14868a73181c0c92758, < ac493452e937b8939eaf2d24cac51a4804b6c20e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for software to interact with the hardware. The vulnerability arises from the failure to zero-initialize the tc skb extension during allocation. This oversight can potentially lead to security vulnerabilities, although the actual impact and attack plausibility have not been proven.
Vulnerability Detail
The vulnerability in the Kernel package occurs due to the lack of zero-initialization of the tc skb extension during allocation. This can result in potential security vulnerabilities, although the specific ramifications are yet to be determined. The vulnerability was introduced in version v5.9 of the Linux Kernel by commit 038ebb1a713d114d54dbf14868a73181c0c92758 and has been fixed in version v5.10.42 by commit ac493452e937b8939eaf2d24cac51a4804b6c20e.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the vulnerability in the Kernel package arises from the failure to zero-initialize the tc skb extension during allocation. While the actual impact and attack plausibility have not been proven, it is recommended to update to version v5.10.42 or later of the Linux Kernel to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as it has not been proven. However, it has the potential to introduce security vulnerabilities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the vulnerability has been fixed in version v5.10.42 of the Linux Kernel. It is recommended to update to this version or later to mitigate the vulnerability.
No specific workaround has been provided for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GSD-2021-1000575.json file available in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000575.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
