Infoleak Vulnerability in struct bcm_msg_head in Kernel
Summary
GSD-2021-1000927: can: bcm: fix infoleak in struct bcm_msg_head. Affects Kernel versions >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < c297559a2a2a6b6f0de61ed333a978a118b0e660. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The bcm (Broadcom Controller Messaging) module in the Kernel is responsible for handling communication with Broadcom network controllers. The struct bcm_msg_head is a data structure used by the bcm module to exchange messages between the Kernel and the network controllers.
Vulnerability Detail
The vulnerability identified as GSD-2021-1000927 is an infoleak in the struct bcm_msg_head data structure. An infoleak occurs when sensitive information is unintentionally disclosed to unauthorized entities. In this case, the vulnerability allows an attacker to leak kernel memory contents to user-space applications by manipulating the bcm_msg_head structure. This could potentially expose sensitive data, such as encryption keys or user credentials, leading to further exploitation or unauthorized access to the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply patches provided by the Linux Kernel community or disable the bcm module if it is not required for their system's functionality. Disabling the bcm module prevents the exploitation of this specific vulnerability. However, it may impact the functionality of Broadcom network controllers if they are being used.
Conclusion
The infoleak vulnerability in the struct bcm_msg_head data structure of the Kernel can lead to the unauthorized disclosure of sensitive information. To mitigate this risk, it is recommended to update the Linux Kernel to version v5.4.128 or later. Alternatively, users can apply provided patches or disable the bcm module if not required. Following security best practices and regularly updating software components are essential for maintaining a secure system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability allows an attacker to leak kernel memory contents, potentially exposing sensitive information and leading to further exploitation or unauthorized access to the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities, including this infoleak vulnerability.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is essential to apply the recommended fix or workaround to mitigate the risk.
In addition to updating the Kernel or applying the provided patches, it is crucial to follow security best practices, such as regularly updating all software components, implementing strong access controls, and monitoring system logs for any suspicious activities.
You can find more information about this vulnerability, including the specific commits and affected versions, in the vulnerability database maintained by the Cloud Security Alliance. The link to the database entry is available in the references section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
