Use-after-free vulnerability in smsc75xx_bind function in Linux Kernel
Summary
GSD-2021-1000987: net: usb: fix possible use-after-free in smsc75xx_bind. Affects Kernel versions >= 635ac38b36255d3cfb8312cf7c471334f4d537e0, < 570a52cf3e01d19f7fd1a251dfc52b0cd86c13cb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for communication between hardware and software. It is a critical component that enables the functioning of various devices and services on a Linux-based system. One of the functionalities provided by the kernel is USB support, which allows devices to be connected and interacted with via USB ports. The smsc75xx_bind function is a part of the USB network driver for the SMSC75xx USB Ethernet Adapter. This driver enables the use of the SMSC75xx USB Ethernet Adapter for network connectivity. However, a use-after-free vulnerability has been discovered in the smsc75xx_bind function, which could potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
Vulnerability Detail
The use-after-free vulnerability in the smsc75xx_bind function occurs when a USB network device is disconnected while still being used by the system. This can lead to a situation where the system attempts to access memory that has already been freed, potentially resulting in a crash or the execution of arbitrary code. An attacker with physical access to a system or the ability to connect and disconnect USB devices could exploit this vulnerability to gain unauthorized access, escalate privileges, or disrupt the normal operation of the system. The vulnerability was introduced in Linux Kernel version v5.10.42 and has been fixed in version v5.10.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the use of the SMSC75xx USB Ethernet Adapter or disconnect it from the system to mitigate the risk of exploitation. However, this may result in the loss of network connectivity if the adapter is being used for network communication.
Conclusion
The use-after-free vulnerability in the smsc75xx_bind function of the Linux Kernel can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. It is recommended to update the kernel to version v5.10.46 or later to mitigate the risk of exploitation. Users can also temporarily disable or disconnect the SMSC75xx USB Ethernet Adapter as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
A use-after-free vulnerability is a type of memory corruption issue that occurs when a program or system continues to use a memory address after it has been freed. This can lead to unpredictable behavior, crashes, or the execution of arbitrary code.
An attacker with physical access to a system or the ability to connect and disconnect USB devices could exploit this vulnerability by disconnecting a USB network device while it is still being used by the system. This can trigger the use-after-free condition and potentially allow the attacker to execute arbitrary code or cause a denial-of-service condition.
The impact of this vulnerability can vary depending on the specific system and its configuration. In some cases, it could allow an attacker to gain unauthorized access, escalate privileges, or disrupt the normal operation of the system. However, the actual impact and attack plausibility have not yet been proven.
Yes, this vulnerability has been fixed in Linux Kernel version v5.10.46. Users are advised to update their kernel to this version or later to mitigate the risk of exploitation.
More information about this vulnerability can be found in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The vulnerability ID is GSD-2021-1000987. You can also refer to the official Linux Kernel repository for details about the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
