Vulnerability in Kernel: neighbour: allow NUD_NOARP entries to be forced GCed
Summary
GSD-2021-1000789: neighbour: allow NUD_NOARP entries to be forced GCed. Affects Kernel versions >= 58956317c8de52009d1a38a721474c24aef74fe7, < d17d47da59f726dc4c87caebda3a50333d7e2fd3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The vulnerability in question affects the neighbour subsystem of the Kernel. The neighbour subsystem is responsible for managing the neighbor cache, which stores information about neighboring devices on the network. This vulnerability allows NUD_NOARP entries in the neighbor cache to be forcibly garbage collected (GCed), potentially leading to unexpected behavior and security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the neighbor subsystem of the Kernel. Specifically, it allows NUD_NOARP entries in the neighbor cache to be forcibly GCed. NUD_NOARP is a flag that indicates that the neighbor entry does not require Address Resolution Protocol (ARP) resolution. By exploiting this vulnerability, an attacker could manipulate the neighbor cache to remove NUD_NOARP entries, potentially disrupting network communication or facilitating ARP spoofing attacks. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.10.43 by commit d17d47da59f726dc4c87caebda3a50333d7e2fd3. However, it was introduced in version v5.0 by commit 58956317c8de52009d1a38a721474c24aef74fe7.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's neighbor subsystem allows NUD_NOARP entries in the neighbor cache to be forcibly GCed, potentially leading to network disruption and security issues. It is crucial to update the Linux Kernel to version v5.10.43 or later to fix this vulnerability. Users can also utilize Vulert to check if their system is affected by this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The neighbor subsystem in the Kernel is responsible for managing the neighbor cache, which stores information about neighboring devices on the network. It helps in resolving IP addresses to MAC addresses and facilitates communication between devices.
NUD_NOARP is a flag used in the neighbor cache entries to indicate that the neighbor entry does not require Address Resolution Protocol (ARP) resolution. It is typically used for devices that do not use ARP, such as devices on a local network segment.
The potential consequences of this vulnerability include disruption of network communication, potential security issues due to manipulation of the neighbor cache, and facilitation of ARP spoofing attacks.
You can use Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can visit the Vulert playground (https://vulert.com/scanner) without any signup to check if your application is affected.
As of now, there is no known exploit for this vulnerability. However, it is always recommended to apply security patches and updates to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
