net: hns3: put off calling register_netdev() until client initialize complete
Summary
GSD-2021-1000578: net: hns3: put off calling register_netdev() until client initialize complete. Affects Kernel versions >= 08a100689d4baf296d6898c687ea8d005da8d234, < a663c1e418a3b5b8e8edfad4bc8e7278c312d6fc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package in the Linux Kernel is responsible for managing network devices and protocols. It provides the necessary infrastructure for network communication within the operating system. The hns3 module within the net package is specifically designed for Huawei HiSilicon Network Subsystem 3 (HNS3) Ethernet controllers. These controllers are commonly used in Huawei network devices. The hns3 module handles the initialization and management of HNS3 network devices. However, a vulnerability has been identified in the hns3 module that could lead to potential security issues.
Vulnerability Detail
The vulnerability in the hns3 module arises from the premature calling of the register_netdev() function before the client initialization is complete. This can result in inconsistent or incomplete initialization of the network device, potentially leading to various security risks. The exact impact and attack vectors of this vulnerability have not been proven yet. It is important to note that this vulnerability affects the Linux Kernel versions from v5.6 to v5.10.41.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually modify the code in the hns3 module to delay the calling of register_netdev() until the client initialization is complete. Here is an example of the modified code:
// Original code
hns3_register_client(client);
register_netdev(netdev);
// Modified code
hns3_register_client(client);
if (client_initialized)
register_netdev(netdev);
Conclusion
The hns3 module in the Linux Kernel has a vulnerability that can lead to security risks. It is recommended to update the kernel to version v5.10.42 or later to fix this issue. A workaround is also available by modifying the code in the hns3 module. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it has the potential to result in security risks due to inconsistent or incomplete initialization of the network device.
This vulnerability affects Linux Kernel versions from v5.6 to v5.10.41.
To fix this vulnerability, update the Linux Kernel to version v5.10.42 or later.
Yes, a workaround is available. Users can modify the code in the hns3 module to delay the calling of register_netdev() until the client initialization is complete.
For more information about this vulnerability, refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
