Fix possible use-after-free vulnerability in watchdog package
Summary
GSD-2021-1001190: watchdog: Fix possible use-after-free by calling del_timer_sync(). Affects Kernel versions < 1a053c4d716898a53c2e31c574a70ea0c37044a3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The watchdog package is a component of the Linux Kernel ecosystem. It provides a mechanism for monitoring the system's health and automatically recovering from certain failures. The watchdog timer is responsible for triggering a system reset if it detects a failure. However, a vulnerability has been discovered in the watchdog package that could lead to a use-after-free scenario.
Vulnerability Detail
The vulnerability in the watchdog package arises from a potential use-after-free issue. Specifically, there is a possibility of accessing memory after it has been freed, which can result in unpredictable behavior and potentially be exploited by attackers. The vulnerability has not been proven to have a specific impact or attack vector yet. It has been fixed in Linux Kernel version v5.13.4 by commit 1a053c4d716898a53c2e31c574a70ea0c37044a3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel as mentioned in the 'how_to_fix' section.
Conclusion
The use-after-free vulnerability in the watchdog package has been fixed in Linux Kernel version v5.13.4. It is crucial to update the kernel to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The watchdog package is a component of the Linux Kernel ecosystem that provides a mechanism for monitoring the system's health and automatically recovering from certain failures.
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed. This can lead to unpredictable behavior and potential security issues.
The actual impact and attack vector of this vulnerability have not been proven yet. However, it is important to apply the fix to prevent potential exploitation.
To fix this vulnerability, update the Linux Kernel to version v5.13.4 or later by pulling the latest changes from the official Linux Kernel repository and recompiling the kernel.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
