Buffer Overflow Vulnerability in be2net Package
Summary
GSD-2022-1004113: be2net: Fix buffer overflow in be_get_module_eeprom. Affects Kernel versions >= e36edd9d26cf257511548edaf2b7a56eb4fed854, < 18043da94c023f3ef09c15017bdb04e8f695ef10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The be2net package is a network driver for Broadcom Ethernet devices in the Linux Kernel. It provides support for various features and functionalities of these devices. The package is an integral part of the Linux Kernel and is widely used in Linux-based systems.
Vulnerability Detail
The be2net package is affected by a buffer overflow vulnerability in the be_get_module_eeprom function. This vulnerability allows an attacker to overflow a buffer, potentially leading to arbitrary code execution or a denial of service. The vulnerability was introduced in version v3.18 of the Linux Kernel and has been fixed in version v5.18.15.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the Linux Kernel to the fixed version.
Conclusion
The buffer overflow vulnerability in the be2net package can lead to arbitrary code execution or a denial of service. It is crucial to update the Linux Kernel to version v5.18.15 or later to mitigate this vulnerability. No known workarounds are available, and it is recommended to apply the fix as soon as possible. For additional support, contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service on a system running the vulnerable version of the be2net package.
You can check if your system is affected by this vulnerability by using the Vulert Playground (https://vulert.com/scanner). Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this specific vulnerability.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over the network. It is recommended to update the Linux Kernel as soon as possible to prevent any potential remote exploitation.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
