Buffer Overflow Vulnerability in be2net Package
Summary
GSD-2022-1004669: be2net: Fix buffer overflow in be_get_module_eeprom. Affects Kernel versions >= e36edd9d26cf257511548edaf2b7a56eb4fed854, < a8569f76df7ec5b4b51155c57523a0b356db5741. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The be2net package is a network driver for Broadcom Ethernet devices in the Linux Kernel. It provides support for various features and functionalities of these devices. The vulnerability in question is a buffer overflow issue that exists in the be_get_module_eeprom function of the be2net driver.
Vulnerability Detail
The buffer overflow vulnerability in be_get_module_eeprom function allows an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or system crashes. This vulnerability was introduced in version v3.18 of the Linux Kernel and was fixed in version v5.4.208. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Linux Kernel to the fixed version as soon as possible.
Conclusion
The buffer overflow vulnerability in the be2net package's be_get_module_eeprom function can potentially lead to arbitrary code execution or system crashes. It is crucial to update the Linux Kernel to version v5.4.208 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The be2net package is a network driver for Broadcom Ethernet devices in the Linux Kernel. It provides support for various features and functionalities of these devices.
A buffer overflow vulnerability occurs when a program writes data beyond the allocated buffer, overwriting adjacent memory locations. This can lead to arbitrary code execution or system crashes.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, the impact and attack plausibility of this vulnerability have not been proven yet. However, it is still important to apply the fix to ensure the security of your system.
No, there is no known workaround for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
