net: encx24j600: check error in devm_regmap_init_encx24j600
Summary
GSD-2021-1001773: net: encx24j600: check error in devm_regmap_init_encx24j600. Affects Kernel versions >= 04fbfce7a222327b97ca165294ef19f0faa45960, < 66358471fa75a713fd76bc8a4bd74cb14cd50a4f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: encx24j600 package is a network driver for the Microchip ENCx24J600 Ethernet controller. It provides support for communication between the Linux kernel and the ENCx24J600 chip. The devm_regmap_init_encx24j600 function is responsible for initializing the register map for the ENCx24J600 chip. This vulnerability affects versions of the Linux Kernel starting from v4.4 and was introduced in commit 04fbfce7a222327b97ca165294ef19f0faa45960.
Vulnerability Detail
The vulnerability in the net: encx24j600 package lies in the failure to check for errors during the initialization of the register map for the ENCx24J600 chip. This oversight could lead to potential security vulnerabilities, although the actual impact and attack plausibility have not been proven. It is important to note that this vulnerability has been fixed in Linux Kernel version v4.4.290 by commit 66358471fa75a713fd76bc8a4bd74cb14cd50a4f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The net: encx24j600 package in the Linux Kernel is vulnerable to a security issue related to the initialization of the register map for the ENCx24J600 chip. It is crucial to update the Linux Kernel to version v4.4.290 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net: encx24j600 package is a network driver for the Microchip ENCx24J600 Ethernet controller, providing support for communication between the Linux kernel and the ENCx24J600 chip.
The impact of this vulnerability is currently unknown, as the actual attack plausibility and impact have not been proven. However, it is important to apply the fix to ensure the security of the system.
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability has been fixed in Linux Kernel version v4.4.290 by commit 66358471fa75a713fd76bc8a4bd74cb14cd50a4f.
To update the Linux Kernel, you can pull the latest updates from the official Linux Kernel repository using the following command:
$ git pull https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
