net: tun: stop NAPI when detaching queues
Summary
GSD-2022-1004815: net: tun: stop NAPI when detaching queues. Affects Kernel versions >= 943170998b200190f99d3fe7e771437e2c51f319, < e90525753e3cf0566ac4917ae98785ff478ede0c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the essential services to enable computer programs to access hardware devices and manage system resources. The 'net' module in the Linux Kernel is responsible for network-related functionality, including network device drivers and protocols. The 'tun' driver is a software-based network device that allows user-space programs to interact with network traffic. This vulnerability affects the 'tun' driver when detaching queues.
Vulnerability Detail
The vulnerability in the 'net: tun' driver occurs when detaching queues. It was introduced in version v4.15 of the Linux Kernel by commit 943170998b200190f99d3fe7e771437e2c51f319 and fixed in version v4.19.251 by commit e90525753e3cf0566ac4917ae98785ff478ede0c. When detaching queues, the NAPI (New API) feature is not properly stopped, potentially leading to security issues. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The 'net: tun: stop NAPI when detaching queues' vulnerability in the Linux Kernel's 'tun' driver can potentially lead to security issues. It is recommended to update the Linux Kernel to version v4.19.251 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel that provides essential services for computer programs.
The 'net' module in the Linux Kernel is responsible for network-related functionality, including network device drivers and protocols.
The 'tun' driver is a software-based network device that allows user-space programs to interact with network traffic.
NAPI (New API) is a feature in the Linux Kernel that provides a more efficient way of handling network interrupts.
To update the Linux Kernel, you can pull the latest changes from the official Linux Kernel repository and compile the kernel with the updated code.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
