net: stmmac: Fix leaks in probe
Summary
GSD-2022-1004175: net: stmmac: fix leaks in probe. Affects Kernel versions >= 2bb4b98b60d7dc89fc0a5bb64534be348ab654df, < dd91bc60f305610401b2196bedb573693d6c8e46. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stmmac driver is a network driver for Ethernet controllers based on the Synopsys DesignWare Ethernet MAC (stmmac) IP core. It is used in the Linux Kernel to provide network connectivity for various devices. The probe function in the stmmac driver is responsible for initializing and configuring the network interface. However, there are memory leaks in the probe function, which can lead to resource exhaustion and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability in the stmmac driver's probe function allows an attacker to cause a denial-of-service condition by repeatedly triggering the probe function and exhausting system resources. This can be exploited by sending a specially crafted network packet to the affected device. The vulnerability was introduced in Linux Kernel version v5.14 and is fixed in version v5.18.13. The fix involves correcting the memory leaks in the probe function to ensure proper resource management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Linux Kernel.
Conclusion
The stmmac driver in the Linux Kernel is vulnerable to memory leaks in the probe function, which can be exploited to cause denial-of-service attacks. It is recommended to update the Linux Kernel to version v5.18.13 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion and potential denial-of-service attacks on devices using the stmmac driver.
An attacker can exploit this vulnerability by sending specially crafted network packets to the affected device, triggering the probe function and causing resource exhaustion.
The vulnerability was introduced in Linux Kernel version v5.14 and is fixed in version v5.18.13.
No, there is no known workaround. It is necessary to update the Linux Kernel to fix the vulnerability.
You can find more information about this vulnerability in the GSD-2022-1004175 JSON file available in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1004xxx/GSD-2022-1004175.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
