net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
Summary
GSD-2022-1003853: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register. Affects Kernel versions >= a3c53be55c955b7150cda17874c3fcb4eeb97a89, < 86c3c5f8e4bd1325e24f6fba9017cade29933377. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and processes. The mv88e6xxx driver is responsible for managing the Marvell 88E6XXX series of Ethernet switches. These switches are commonly used in network devices to enable communication between different network segments. The mv88e6xxx_mdios_register function is a part of this driver and is used to register the MDIO bus for the switch. The MDIO bus is a standard interface for communication between Ethernet PHYs and Ethernet switches.
Vulnerability Detail
The vulnerability in the mv88e6xxx_mdios_register function leads to a refcount leak. When the function fails to register the MDIO bus, it does not properly release the reference count, resulting in a resource leak. This can lead to memory leaks and potential denial-of-service attacks. An attacker could exploit this vulnerability by repeatedly triggering the failure condition, causing the system to exhaust its resources and become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to apply the fix mentioned above by updating the Linux Kernel to the latest version.
Conclusion
In conclusion, the mv88e6xxx_mdios_register function in the mv88e6xxx driver of the Kernel package is vulnerable to a refcount leak issue. This vulnerability can lead to memory leaks and potential denial-of-service attacks. To mitigate the risk, it is recommended to update the Linux Kernel to version v4.19.247 or later. Users can obtain the updated Kernel from the official Linux Kernel repository. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to memory leaks and potential denial-of-service attacks. An attacker could exploit this vulnerability to exhaust system resources and render the system unresponsive.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can trigger the failure condition remotely, causing the system to exhaust its resources and become unresponsive.
For more details about this vulnerability, you can refer to the vulnerability ID GSD-2022-1003853 in the GSD database maintained by the Cloud Security Alliance. The source link for this vulnerability is https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003853.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
