usbnet: Run unregister_netdev() before unbind() again
Summary
GSD-2022-1003371: usbnet: Run unregister_netdev() before unbind() again. Affects Kernel versions < 6d5deb242874d924beccf7eb3cef04c1c3b0da79. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The usbnet package is a part of the Linux Kernel ecosystem. It provides support for USB network devices, allowing them to be used as network interfaces in the Linux operating system. These USB network devices can include Ethernet adapters, modems, and other similar devices. The package handles the initialization, configuration, and management of these USB network devices within the Linux Kernel.
Vulnerability Detail
The vulnerability identified as GSD-2022-1003371 in the usbnet package involves the improper sequence of operations during the unbinding process. Specifically, the unregister_netdev() function is not called before the unbind() function is invoked again. This can lead to potential security vulnerabilities, although the exact impact and attack plausibility have not been proven. The vulnerability has been fixed in the Linux Kernel version v5.15.46 by commit 6d5deb242874d924beccf7eb3cef04c1c3b0da79.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The usbnet package in the Linux Kernel is vulnerable to a sequence of operations during the unbinding process. This vulnerability has been fixed in the Linux Kernel version v5.15.46. To ensure the security of systems using USB network devices, it is recommended to update the Linux Kernel to the fixed version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
usbnet is a package in the Linux Kernel ecosystem that provides support for USB network devices, allowing them to be used as network interfaces in the Linux operating system.
The exact impact of this vulnerability is not yet proven. However, it has the potential to introduce security vulnerabilities in systems using USB network devices.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.46 or later.
The fixed version of the Linux Kernel can be obtained from the official Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/.
Yes, users can wait for their Linux distribution to provide an updated package containing the fixed version of the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
