Use-after-free vulnerability in watchdog package
Summary
GSD-2021-1001447: watchdog: Fix possible use-after-free by calling del_timer_sync(). Affects Kernel versions < ca96b8ea5e74956071154bdb456778cc3027e79f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The watchdog package is a component of the Linux Kernel that provides a mechanism for monitoring the system's health and ensuring its proper functioning. It includes a timer-based watchdog device that can be used to detect and recover from system failures. The package is widely used in Linux-based systems to enhance their reliability and availability.
Vulnerability Detail
The identified vulnerability in the watchdog package is a use-after-free issue that can potentially lead to a security breach. Specifically, there is a possibility of accessing memory after it has been freed, which can result in unpredictable behavior and potentially be exploited by malicious actors. The vulnerability has been addressed in the Linux Kernel version v4.9.276 through the commit ca96b8ea5e74956071154bdb456778cc3027e79f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the fix mentioned above to ensure the security and stability of the system.
Conclusion
The use-after-free vulnerability in the watchdog package of the Linux Kernel has been identified and addressed in version v4.9.276. It is crucial for users to update their kernel to the fixed version or apply the provided patch to ensure the security and stability of their systems. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various issues, including crashes, data corruption, and potential security exploits.
Exploiting this vulnerability could allow an attacker to execute arbitrary code, escalate privileges, or cause a denial-of-service condition on the affected system.
Yes, this vulnerability affects versions of the Linux Kernel prior to v4.9.276. The fix has been implemented in the mentioned commit and subsequent versions.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the fix to mitigate any potential risks.
You can find more information about this vulnerability, including the commit that addresses it, in the provided source link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001447.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
