Use-after-free vulnerability in net: bonding package
Summary
GSD-2022-1004228: net: bonding: fix use-after-free after 802.3ad slave unbind. Affects Kernel versions >= 0622cab0341cac6b30da177b0faa39fae0680e71, < 2765749def4765c5052a4c66445cf4c96fcccdbc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: bonding package is a part of the Linux Kernel, which is responsible for managing network interfaces and providing network bonding functionality. Network bonding allows multiple network interfaces to be combined into a single logical interface, providing increased bandwidth and fault tolerance. The bonding driver supports various bonding modes, including the 802.3ad mode, which uses Link Aggregation Control Protocol (LACP) to dynamically aggregate multiple links.
Vulnerability Detail
The use-after-free vulnerability in the net: bonding package occurs when an 802.3ad slave is unbound. This vulnerability was introduced in version v4.7 of the Linux Kernel and was fixed in version v5.18.10. When an 802.3ad slave is unbound, a use-after-free condition can occur, leading to potential memory corruption or a system crash. An attacker with local access to the system could exploit this vulnerability to execute arbitrary code or escalate privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk.
Conclusion
The use-after-free vulnerability in the net: bonding package can lead to memory corruption or system crashes. It is crucial to update the Linux Kernel to version v5.18.10 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net: bonding package is a component of the Linux Kernel that provides network bonding functionality, allowing multiple network interfaces to be combined into a single logical interface.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to memory corruption or crashes.
An attacker with local access to the system can exploit this vulnerability by unbinding an 802.3ad slave, triggering a use-after-free condition and potentially executing arbitrary code or escalating privileges.
No, there is no known workaround for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
To update the Linux Kernel, you can obtain the fixed version from the official Linux Kernel repository and apply the necessary updates to your system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
