Vulnerability in Kernel package: bcm: fix infoleak in struct bcm_msg_head
Summary
GSD-2021-1001073: can: bcm: fix infoleak in struct bcm_msg_head. Affects Kernel versions >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < dc6415cb5cf8ebc8b334b7d0be916a0bf4353779. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functions and facilitating communication between hardware and software. It provides essential services such as memory management, process scheduling, and device drivers. The vulnerability in the bcm (Broadcom Controller Messaging) module of the Kernel package allows for an information leak in the struct bcm_msg_head data structure. This vulnerability could potentially be exploited by an attacker to gain unauthorized access to sensitive information or execute arbitrary code.
Vulnerability Detail
The vulnerability arises from a flaw in the struct bcm_msg_head data structure within the bcm module of the Kernel package. This flaw allows an attacker to leak kernel memory, potentially exposing sensitive information. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.12.13 by commit dc6415cb5cf8ebc8b334b7d0be916a0bf4353779. However, it was introduced in version v2.6.25 by commit ffd980f976e7fd666c2e61bf8ab35107efd11828.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if updating the Kernel package is not immediately feasible, it is recommended to implement additional security measures such as access controls and monitoring to mitigate the risk of exploitation. However, applying the official fix by updating the Kernel package is the most effective solution.
Conclusion
The vulnerability in the Kernel package's bcm module, allowing for an infoleak in the struct bcm_msg_head data structure, poses a potential risk of unauthorized access to sensitive information. It is crucial to update the Kernel package to version v5.12.13 or later to mitigate this vulnerability. Implementing additional security measures and monitoring can serve as temporary workarounds until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functions and facilitating communication between hardware and software.
The bcm (Broadcom Controller Messaging) module is a component within the Kernel package that handles communication with Broadcom controllers.
An infoleak vulnerability refers to a security flaw that allows an attacker to gain unauthorized access to sensitive information by leaking data from the system's memory or other sources.
This vulnerability can potentially be exploited by an attacker to leak kernel memory, which may contain sensitive information. However, the actual impact and attack plausibility have not been proven yet.
Yes, this vulnerability has been fixed in Linux Kernel version v5.12.13 by commit dc6415cb5cf8ebc8b334b7d0be916a0bf4353779.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
