Vulnerability in Kernel: net: phy: micrel: Allow probing without .driver_data
Summary
GSD-2022-1003988: net: phy: micrel: Allow probing without .driver_data. Affects Kernel versions < 7dcb404662839a4ed1a9703658fee979eb894ca4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between software and hardware. It provides essential functions and services for the proper functioning of the system. The net: phy: micrel module is responsible for handling network physical layer devices manufactured by Micrel. These devices include Ethernet PHYs (Physical Layer Transceivers) that enable network connectivity. The vulnerability in this module allows probing without .driver_data, potentially leading to security issues.
Vulnerability Detail
The vulnerability in the net: phy: micrel module allows for probing without .driver_data, which can have security implications. The .driver_data field is used to store driver-specific data and is typically initialized during device probing. However, in this case, the module allows probing without initializing this field, which can result in undefined behavior or potential security vulnerabilities. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the net: phy: micrel module has been identified and fixed in Linux Kernel version v4.14.283. Users are advised to update their Kernel to this version or a later one to ensure the security of their systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net: phy: micrel module is responsible for handling network physical layer devices manufactured by Micrel, such as Ethernet PHYs.
The .driver_data field is used to store driver-specific data and is typically initialized during device probing.
The vulnerability allows probing without initializing the .driver_data field, which can result in undefined behavior or potential security vulnerabilities.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix the vulnerability, users should update their Kernel to version v4.14.283 or a later one that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
