Use After Free Vulnerability in Kernel
Summary
GSD-2021-1001421: misc/libmasm/module: Fix two use after free in ibmasm_init_one. Affects Kernel versions < 5b06ca113bf197aab2ab61288f42506e0049fbab. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. However, a use after free vulnerability has been discovered in the Kernel's misc/libmasm/module module. This vulnerability can potentially be exploited by attackers to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The use after free vulnerability in the misc/libmasm/module module of the Kernel arises from two instances of improper handling of memory deallocation. Specifically, the ibmasm_init_one function fails to properly handle memory freeing, leading to a use after free scenario. An attacker could exploit this vulnerability by crafting a malicious input that triggers the use after free condition, potentially allowing them to execute arbitrary code or crash the system. This vulnerability has been assigned the ID GSD-2021-1001421 and has been fixed in Linux Kernel version v4.14.240 by commit 5b06ca113bf197aab2ab61288f42506e0049fbab.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable or remove the misc/libmasm/module module from the Kernel configuration if it is not required for their specific use case. This can be done by modifying the Kernel configuration file and rebuilding the Kernel without including the module. However, this workaround should only be considered if the module is not essential for the system's functionality.
Conclusion
In conclusion, a use after free vulnerability has been identified in the misc/libmasm/module module of the Linux Kernel. This vulnerability can potentially allow attackers to execute arbitrary code or cause a denial of service. It is crucial to update the Kernel to version v4.14.240 or later to mitigate this vulnerability. Alternatively, users can disable or remove the module if it is not required. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow attackers to execute arbitrary code or cause a denial of service by exploiting the use after free condition in the misc/libmasm/module module of the Kernel.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability has been fixed in Linux Kernel version v4.14.240 by commit 5b06ca113bf197aab2ab61288f42506e0049fbab.
Yes, as a temporary measure, you can disable or remove the misc/libmasm/module module from the Kernel configuration if it is not essential for your system's functionality. However, it is recommended to apply the official fix as soon as possible.
You can find more information about this vulnerability, including the technical details and the fix, in the official Linux Kernel Git repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
