Use-after-free vulnerability in sc520_wdt module of Linux Kernel
Summary
GSD-2021-1001195: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff(). Affects Kernel versions < f0feab82f6a0323f54d85e8b512a2be64f83648a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sc520_wdt module is a watchdog timer driver in the Linux Kernel. It is responsible for monitoring the system and resetting it if necessary. The sc520_wdt module specifically handles the watchdog timer functionality for the National Semiconductor SC520 processor. The watchdog timer is a crucial component for ensuring system stability and preventing system lock-ups. However, a use-after-free vulnerability has been discovered in the wdt_turnoff() function of the sc520_wdt module.
Vulnerability Detail
The use-after-free vulnerability in the wdt_turnoff() function of the sc520_wdt module can be exploited by an attacker to potentially execute arbitrary code or cause a denial-of-service condition. This vulnerability occurs when the wdt_turnoff() function is called after the watchdog timer has been disabled, leading to a use-after-free scenario. An attacker with local access to the system may be able to trigger this vulnerability and gain elevated privileges or disrupt the system's operation.
How To Fix
No fixed version is published for this vulnerability.
The use-after-free vulnerability in the sc520_wdt module has been fixed in the Linux Kernel version v5.13.4. To fix this vulnerability, it is recommended to update the Linux Kernel to the latest version available. This can be done by downloading the updated kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it for the target system. Alternatively, users can wait for their Linux distribution to provide an updated package containing the fixed kernel version.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the sc520_wdt module if it is not required for their system's operation. This can be done by blacklisting the module or removing it from the kernel configuration. However, it is important to note that disabling the watchdog timer functionality may leave the system vulnerable to other types of issues related to system stability and lock-ups.
Conclusion
The use-after-free vulnerability in the sc520_wdt module of the Linux Kernel can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is recommended to update the Linux Kernel to version v5.13.4 or later to mitigate this vulnerability. Users can also temporarily disable the sc520_wdt module as a workaround, but this may leave the system vulnerable to other issues related to system stability and lock-ups. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The use-after-free vulnerability in the sc520_wdt module can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. This can lead to unauthorized access, privilege escalation, or disruption of the system's operation.
Any system running the Linux Kernel with the sc520_wdt module enabled and prior to version v5.13.4 is affected by this vulnerability. Systems with the National Semiconductor SC520 processor are particularly vulnerable.
No, this vulnerability requires local access to the system in order to exploit it.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, the use-after-free vulnerability in the sc520_wdt module has been fixed in the Linux Kernel version v5.13.4.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.