Vulnerability in Kernel package: s390/pci: fix zpci_zdev_put() on reserve
Summary
GSD-2021-1001833: s390/pci: fix zpci_zdev_put() on reserve. Affects Kernel versions >= a69326e134d4ffa0d2d77bf1a4a62271c51c3051, < 188907c252188ac7a5ec3efcfa31dae1f47b8a20. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software, allowing applications to communicate with the underlying hardware resources. The s390/pci module within the Kernel package specifically handles PCI device management on IBM System z architectures. This vulnerability affects the zpci_zdev_put() function in the s390/pci module.
Vulnerability Detail
The zpci_zdev_put() function in the s390/pci module of the Kernel package is vulnerable to a security issue. The vulnerability was introduced in version v5.10.61 of the Linux Kernel by commit a69326e134d4ffa0d2d77bf1a4a62271c51c3051 and fixed in version v5.10.76 by commit 188907c252188ac7a5ec3efcfa31dae1f47b8a20. The exact impact and attack plausibility of this vulnerability have not been proven yet. However, it is crucial to address this issue to ensure the security and stability of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the s390/pci module in the Kernel package is vulnerable to a security issue in the zpci_zdev_put() function. It is recommended to update the Linux Kernel package to version v5.10.76 or later to address this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is currently unknown. However, it is essential to address it to prevent potential security breaches or system instability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
As of now, no known exploits have been reported for this vulnerability. However, it is crucial to apply the recommended fix to mitigate any potential risks.
It is not recommended to manually patch the affected function without updating the entire Kernel package. Patching individual functions may introduce compatibility issues and could lead to an unstable system. It is best to follow the official update process or install the updated Kernel version from the official Git repository.
You can find more information about this vulnerability in the official Linux Kernel Git repository. The vulnerability details can be accessed using the following link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001833.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
