Vulnerability in Linux Kernel: bpf Subprog Poke Descriptors Tracking Issue
Summary
GSD-2021-1001253: bpf: Track subprog poke descriptors correctly and fix use-after-free. Affects Kernel versions >= a748c6975dea325da540610c2ba9b5f332c603e6, < a9f36bf3613c65cb587c70fac655c775d911409b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionality. It is a widely used open-source package that powers numerous devices and servers. The bpf (Berkeley Packet Filter) subsystem within the Linux Kernel allows for efficient packet filtering and processing. However, a vulnerability has been discovered in the bpf subsystem that affects the tracking of subprog poke descriptors, leading to a use-after-free issue.
Vulnerability Detail
The vulnerability in the bpf subsystem arises from incorrect tracking of subprog poke descriptors. This can result in a use-after-free condition, where a program continues to reference memory after it has been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service by crashing the system. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Linux Kernel version v5.10 and has been fixed in version v5.10.53 by commit a9f36bf3613c65cb587c70fac655c775d911409b.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.53 or later. This can be done by obtaining the updated kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it according to the provided instructions. Alternatively, users can wait for their Linux distribution to release an updated package containing the fixed version of the kernel.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, a vulnerability has been discovered in the bpf subsystem of the Linux Kernel, specifically related to the tracking of subprog poke descriptors. This vulnerability can result in a use-after-free issue, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service. It is recommended to update the Linux Kernel to version v5.10.53 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionality.
The bpf (Berkeley Packet Filter) subsystem is a component within the Linux Kernel that allows for efficient packet filtering and processing.
A use-after-free vulnerability occurs when a program continues to reference memory after it has been freed. This can lead to crashes, data corruption, or the execution of arbitrary code.
An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service by crashing the system.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.