Vulnerability in Kernel package: efi/libstub read overflow in find_file_option()
Summary
GSD-2021-1000763: efi/libstub: prevent read overflow in find_file_option(). Affects Kernel versions >= 7a88a6227dc7f2e723bba11ece05e57bd8dce8e4, < 951f8ef71d691f754483cc9d871cb493379fdb35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It includes various subsystems and modules that enable hardware interaction, process management, and other essential operations. The efi/libstub module within the Kernel package provides support for the Extensible Firmware Interface (EFI) boot stub, allowing the system to boot using EFI firmware. This module is vulnerable to a read overflow in the find_file_option() function, which can potentially be exploited by attackers to execute arbitrary code or cause a denial-of-service (DoS) condition.
Vulnerability Detail
The vulnerability in the efi/libstub module arises from a read overflow in the find_file_option() function. This function is responsible for parsing EFI boot options and locating the specified file. However, due to a lack of proper bounds checking, an attacker can craft a malicious EFI boot option that triggers a read overflow, leading to memory corruption and potential code execution. The impact of this vulnerability can range from privilege escalation to system compromise, depending on the attacker's capabilities and the system's configuration. It is crucial to address this vulnerability promptly to mitigate the risk of exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the EFI boot stub functionality by modifying the system's boot configuration. This can be achieved by editing the bootloader configuration file (e.g., GRUB configuration) and removing or commenting out any references to the EFI boot stub. By disabling the EFI boot stub, the vulnerable code path in the efi/libstub module is bypassed, reducing the risk of exploitation. However, this workaround may impact the system's ability to boot using EFI firmware, so it should only be considered as a temporary measure until the package update is applied.
Conclusion
The vulnerability in the efi/libstub module of the Kernel package poses a significant risk to Linux systems. It is crucial to update the Kernel package to version v5.10.43 or later to address the read overflow vulnerability. In the meantime, users can apply the temporary workaround of disabling the EFI boot stub functionality. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and the system's configuration. It can potentially lead to privilege escalation, arbitrary code execution, or denial-of-service (DoS) conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any open-source vulnerabilities, including this one, are detected.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is essential to apply the recommended updates promptly to mitigate the risk of exploitation.
While updating the Kernel package is the recommended approach, you can temporarily mitigate the risk by disabling the EFI boot stub functionality as described in the workaround section. However, this should only be considered as a temporary measure, and it is crucial to apply the package update as soon as possible.
You can find more information about this vulnerability, including the specific code changes and patches, in the official Linux Kernel repository. The vulnerability ID GSD-2021-1000763 provides a direct link to the relevant JSON file in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000763.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
