Vulnerability in Kernel package: usb: hso: fix error handling code of hso_create_net_device
Summary
GSD-2021-1001162: usb: hso: fix error handling code of hso_create_net_device. Affects Kernel versions >= 5fcfb6d0bfcda17f0d0656e4e5b3710af2bbaae5, < eeaa4b8d1e2e6f10362673d283a97dccc7275afa. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and processes. The usb subsystem within the Kernel package handles USB devices and their drivers. One of the drivers, hso, is responsible for supporting High-Speed Option (HSO) devices, such as certain 3G/4G modems. The hso_create_net_device function is used to create a network device for these modems.
Vulnerability Detail
The vulnerability identified in the hso_create_net_device function of the hso driver can lead to potential security issues. The error handling code within this function is flawed, which may result in improper handling of errors during the creation of network devices for HSO modems. An attacker could potentially exploit this vulnerability to trigger a denial-of-service condition or execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the fix by updating the Kernel package to the latest version.
Conclusion
The vulnerability in the Kernel package's hso driver can potentially lead to security issues, including denial-of-service and arbitrary code execution. It is crucial to update the Kernel package to the latest version to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to a denial-of-service condition or allow an attacker to execute arbitrary code with kernel privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
At the time of this report, no known exploits for this vulnerability have been disclosed. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
The recommended solution is to update the Kernel package to the latest version. There are no known alternative solutions or workarounds provided for this specific vulnerability.
You can find more information about this vulnerability in the GSD-2021-1001162 entry of the GSD database maintained by the Cloud Security Alliance. The source link is available in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
