Vulnerability in Linux Kernel: Revert "evm: Fix memleak in init_desc"
Summary
GSD-2022-1004581: Revert "evm: Fix memleak in init_desc". Affects Kernel versions < 9d883b3f000d405d19b3484e3d8d97796e6854c6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a critical component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is widely used in various devices, including servers, desktops, and embedded systems. The vulnerability in question relates to a specific fix in the evm (Extended Verification Module) subsystem of the Linux Kernel.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1004581, is a result of a flawed fix in the evm subsystem. The fix was intended to address a memory leak issue in the initialization of descriptors. However, it introduced a new vulnerability that could potentially be exploited by attackers. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.10.132 by commit 9d883b3f000d405d19b3484e3d8d97796e6854c6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the Linux Kernel related to the flawed fix in the evm subsystem has been identified and fixed in version v5.10.132. It is recommended to update the kernel to the fixed version or apply the provided fix to ensure the security of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as the attack plausibility has not been proven. However, it is always recommended to apply security updates to mitigate potential risks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
No known exploit for this vulnerability has been reported at this time. However, it is still important to apply the fix to ensure the security of your system.
While there is no specific workaround mentioned for this vulnerability, it is generally recommended to follow security best practices such as keeping your system up to date with the latest patches and using additional security measures like firewalls and intrusion detection systems.
You can find more information about this vulnerability, including the fix commit, in the GSD-2022-1004581 entry of the GSD Database maintained by the Cloud Security Alliance. The link to the entry is provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
