Use-after-free vulnerability in iio: trigger: sysfs
Summary
GSD-2022-1004625: iio: trigger: sysfs: fix use-after-free on remove. Affects Kernel versions >= f38bc926d022ebd67baad6ac7fc22c95fbc6238c, < b07a30a774b3c3e584a68dc91779c68ea2da4813. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iio: trigger: sysfs is a component of the Linux Kernel, which is responsible for managing triggers for the Industrial I/O subsystem. This subsystem provides support for various sensors and devices. The sysfs interface allows userspace applications to interact with the triggers by reading and writing attributes. However, a use-after-free vulnerability has been discovered in the sysfs component, which can lead to potential security issues.
Vulnerability Detail
The use-after-free vulnerability in iio: trigger: sysfs occurs when a trigger is removed while it is still being accessed by userspace applications. This can result in a situation where the trigger object is freed from memory, but references to it still exist. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v3.7 of the Linux Kernel and has been fixed in version v5.10.127.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.127 or later. This can be done by downloading the latest stable version of the Linux Kernel from the official repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and following the installation instructions provided. It is important to ensure that the updated Kernel is compatible with the specific system configuration.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the use of triggers in the affected system. This can be achieved by modifying the system configuration to prevent the loading of the iio: trigger: sysfs module. However, this workaround may impact the functionality of certain sensors and devices that rely on triggers.
Conclusion
The use-after-free vulnerability in iio: trigger: sysfs can pose a significant security risk to systems running the affected versions of the Linux Kernel. It is crucial to update the Kernel to the fixed version or apply the recommended workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
iio: trigger: sysfs is a component of the Linux Kernel that manages triggers for the Industrial I/O subsystem, which supports various sensors and devices.
The use-after-free vulnerability occurs when a trigger is removed while it is still being accessed by userspace applications, leading to references to freed memory.
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system.
The vulnerability was introduced in version v3.7 of the Linux Kernel and has been fixed in version v5.10.127.
A possible workaround is to disable the use of triggers in the affected system, but this may impact the functionality of certain sensors and devices.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.