Vulnerability in Kernel package: net: bridge: fix vlan tunnel dst refcnt when egressing
Summary
GSD-2021-1000935: net: bridge: fix vlan tunnel dst refcnt when egressing. Affects Kernel versions >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd, < 79855be6445b6592bddb7bd7167083ec8cdbd73f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The net: bridge module within the Kernel package handles network bridging, enabling communication between different network interfaces. This vulnerability specifically affects the handling of VLAN tunnel destination reference count when egressing.
Vulnerability Detail
The vulnerability arises from an issue in the net: bridge module of the Kernel package. When egressing VLAN tunnels, the destination reference count is not properly managed, leading to potential security risks. Although the impact and attack plausibility have not been proven, this vulnerability could potentially be exploited by malicious actors to gain unauthorized access or disrupt network communication. The vulnerability was introduced in version v4.11 of the Linux Kernel and has been fixed in version v5.4.128.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the Kernel package's net: bridge module, which affects the handling of VLAN tunnel destination reference count when egressing, has been identified and fixed in version v5.4.128 of the Linux Kernel. To ensure the security and stability of your system, it is crucial to update the Kernel package to the latest version. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow unauthorized access or disrupt network communication.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if any open-source vulnerabilities, including this one, are found.
There is currently no known exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
The remote exploitability of this vulnerability has not been determined. However, it is advisable to update the Kernel package to the latest version to ensure the system is protected against any potential remote attacks.
The recommended mitigation is to update the Kernel package to version v5.4.128 or later, as it includes the necessary fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
