Vulnerability in Kernel: net: phy: micrel: Allow probing without .driver_data
Summary
GSD-2022-1002753: net: phy: micrel: Allow probing without .driver_data. Affects Kernel versions < bd219273b4e004a3f853da72e111fc8f81357501. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential services and functions to ensure the proper functioning of the system. The net: phy: micrel module is responsible for handling the Micrel PHY devices, which are used for Ethernet communication. These devices require specific driver data to be provided during probing to ensure proper initialization and operation.
Vulnerability Detail
The vulnerability in the net: phy: micrel module allows probing without providing the required .driver_data. This oversight can lead to uninitialized or incorrect configuration of the Micrel PHY devices, potentially resulting in network connectivity issues, data corruption, or even system crashes. Attackers may exploit this vulnerability to disrupt network communication or gain unauthorized access to the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by modifying the code in the net: phy: micrel module. Specifically, the probing function should be modified to check for the presence of .driver_data and handle the absence gracefully. Here is an example of the modified code:
// Original code
probe(struct phy_device *phydev)
{
// Existing code
}
// Modified code
probe(struct phy_device *phydev)
{
if (!phydev->driver_data) {
// Handle absence of .driver_data
}
// Existing code
}
Conclusion
The vulnerability in the net: phy: micrel module of the Kernel can lead to network connectivity issues, data corruption, or system crashes. It is crucial to update the Linux Kernel to version v5.18.3 or later to address this vulnerability. Alternatively, the provided workaround can be implemented until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to network connectivity issues, data corruption, or system crashes. Attackers may exploit it to disrupt network communication or gain unauthorized access.
Updating the Linux Kernel to version v5.18.3 or later will fix the vulnerability. Alternatively, you can apply the provided workaround until the update is applied.
The vulnerability is present in versions prior to v5.18.3. It is recommended to update to the latest stable version to ensure the fix is applied.
Yes, this vulnerability can be exploited remotely if the system is accessible over the network. Attackers can exploit it to disrupt network communication or gain unauthorized access.
There is no known instance of this vulnerability being exploited in the wild. However, it is important to apply the fix or workaround to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
