Vulnerability in ftrace: Blindly Reading IP Address
Summary
GSD-2021-1000875: ftrace: Do not blindly read the ip address in ftrace_bug(). Affects Kernel versions >= 05736a427f7e16be948ccbf39782bd3a6ae16b14, < 862dcc14f2803c556bdd73b43c27b023fafce2fb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ftrace package is a component of the Linux Kernel, which is responsible for tracing and debugging kernel functions. It provides a mechanism to record and analyze the execution flow of the kernel. The ftrace_bug() function within the package is used to report errors and bugs during tracing. However, a vulnerability has been identified in this function, where it blindly reads the IP address without proper validation.
Vulnerability Detail
The vulnerability in ftrace_bug() allows an attacker to manipulate the IP address, potentially leading to a denial of service (DoS) or privilege escalation. By providing a malicious IP address, an attacker could trigger unexpected behavior or crash the system. This vulnerability was introduced in version v2.6.28 of the Linux Kernel and has been fixed in version v4.19.195.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version.
Conclusion
The vulnerability in ftrace's ftrace_bug() function can be mitigated by updating the Linux Kernel to version v4.19.195 or later. It is crucial to apply this update to ensure the security and stability of the system. For further support or assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ftrace is a component of the Linux Kernel that provides tracing and debugging capabilities for kernel functions.
The vulnerability allows an attacker to manipulate the IP address, potentially leading to a denial of service or privilege escalation.
To fix this vulnerability, update the Linux Kernel to version v4.19.195 or later.
No, there is no known workaround for this vulnerability.
You can obtain the updated Linux Kernel from the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
