Use-after-free vulnerability in nicstar_cleanup() function in atm: nicstar
Summary
GSD-2021-1001232: atm: nicstar: Fix possible use-after-free in nicstar_cleanup(). Affects Kernel versions < 5b991df8881088448cb223e769e37cab8dd40706. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The atm: nicstar package is a component of the Linux Kernel, which is responsible for handling Asynchronous Transfer Mode (ATM) network interfaces. The nicstar_cleanup() function is a part of this package and is used to clean up resources when a nicstar device is removed from the system.
Vulnerability Detail
The nicstar_cleanup() function in atm: nicstar is vulnerable to a use-after-free issue. This vulnerability occurs when the function attempts to access memory that has already been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk.
Conclusion
The use-after-free vulnerability in the nicstar_cleanup() function of the atm: nicstar package can be mitigated by updating the Linux Kernel to version v5.13.3 or later. It is crucial to apply the necessary fix to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to update your system to the fixed version to prevent any potential exploitation.
Unfortunately, there are no known mitigations available for this vulnerability other than updating the Linux Kernel to the fixed version. It is recommended to prioritize the update to ensure the security of your system.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2021-1001232. The link to the database entry is provided in the references section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
