Out-of-bounds bug in ngene_command_config_free_buf() in Kernel
Summary
GSD-2021-1001173: media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf(). Affects Kernel versions >= dae52d009fc950b5c209260d50fcc000f5becd3c, < b9a178f189bb6d75293573e181928735f5e3e070. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that manages the system's resources and facilitates communication between hardware and software. It provides essential functions and services for the proper functioning of the system. The ngene driver is responsible for supporting the NXP SAA7146-based DVB cards. These cards are used for digital video broadcasting on Linux systems. However, a vulnerability has been discovered in the ngene_command_config_free_buf() function, which can lead to out-of-bounds memory access.
Vulnerability Detail
The ngene_command_config_free_buf() function in the ngene driver of the Kernel is vulnerable to an out-of-bounds bug. This vulnerability was introduced in version v2.6.34 of the Kernel and has been present in subsequent versions until it was fixed in version v5.13.6. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information or execute arbitrary code. The bug occurs when freeing a buffer, leading to an out-of-bounds read or write operation. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Kernel to the fixed version to mitigate the risk of exploitation.
Conclusion
The ngene driver in the Linux Kernel is vulnerable to an out-of-bounds bug in the ngene_command_config_free_buf() function. This vulnerability can potentially lead to unauthorized access or arbitrary code execution. It is crucial to update the Kernel to version v5.13.6 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, an attacker could gain unauthorized access to sensitive information or execute arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is crucial to update the Kernel to the fixed version.
You can obtain the fixed version of the Kernel from the official Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
This vulnerability was discovered by an automated ID intended to aid in the discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
