UAF Vulnerability in net: fddi: fix fza_probe
Summary
GSD-2021-1001151: net: fddi: fix UAF in fza_probe. Affects Kernel versions >= 61414f5ec9834df8aa4f55c90de16b71a3d6ca8d, < bdfbb51f7a437ae8ea91317a5c133ec13adf3c47. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net package in the Linux Kernel is responsible for handling network-related functionalities. It includes various protocols and drivers for different network interfaces. One of these drivers is fddi, which stands for Fiber Distributed Data Interface. FDDI is a standard for transmitting data over fiber optic cables. The fza_probe function in the fddi driver is vulnerable to a Use-After-Free (UAF) issue.
Vulnerability Detail
The UAF vulnerability in fza_probe arises from improper handling of certain operations on the fddi driver. This can lead to a situation where a pointer to a freed memory object is still accessible, potentially allowing an attacker to exploit this condition and execute arbitrary code or cause a denial of service. The vulnerability was introduced in version v4.20 of the Linux Kernel and has been fixed in version v5.13.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the fddi driver or disable the corresponding functionality in their systems until the kernel is updated to a fixed version. However, this may not be feasible in all scenarios, and it is strongly advised to apply the official fix as soon as possible.
Conclusion
The UAF vulnerability in the fza_probe function of the fddi driver in the Linux Kernel can lead to potential code execution or denial of service. It is crucial to update the kernel to version v5.13.5 or later to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The UAF vulnerability in fza_probe can potentially allow an attacker to execute arbitrary code or cause a denial of service on affected systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate potential risks.
As mentioned in the workaround section, you can disable the fddi driver or corresponding functionality in your system until the kernel is updated. However, it is crucial to apply the official fix as soon as possible.
You can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001151.json for more details and updates on this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
