Vulnerability in Kernel package: net: dsa: microchip
Summary
GSD-2021-1001905: net: dsa: microchip: Added the condition for scheduling ksz_mib_read_work. Affects Kernel versions >= 469b390e1ba330e888175e55d78573db2e9a8cb4, < 383239a33cf29ebee9ce0d4e0e5c900b77a16148. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing core system functions and providing an interface between hardware and software. It includes various subsystems, such as networking, file systems, and device drivers. The net: dsa: microchip module within the Kernel package specifically handles the Microchip Data Switch Architecture (DSA) for Ethernet switches. This module allows for the configuration and management of DSA switches in a network environment.
Vulnerability Detail
The net: dsa: microchip module in the Kernel package is affected by a vulnerability that allows for the scheduling of ksz_mib_read_work without proper conditions. This vulnerability was introduced in version v5.7 of the Linux Kernel by commit 469b390e1ba330e888175e55d78573db2e9a8cb4 and was fixed in version v5.14.14 by commit 383239a33cf29ebee9ce0d4e0e5c900b77a16148. The impact and attack plausibility of this vulnerability have not been proven yet. However, if exploited, it could potentially lead to unauthorized access, denial of service, or other security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net: dsa: microchip module in the Kernel package is affected by a vulnerability that allows for the scheduling of ksz_mib_read_work without proper conditions. It is recommended to update the Linux Kernel package to version v5.14.14 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but if exploited, it could lead to unauthorized access, denial of service, or other security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time monitoring and alerts for open-source vulnerabilities.
There are currently no known exploits for this vulnerability.
Yes, a patch is available in version v5.14.14 of the Linux Kernel.
You can find more information about this vulnerability in the GSD-2021-1001905.json file on the GSD Database GitHub repository (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001905.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
