Shift-Out-of-Bound Vulnerability in nvmem Package
Summary
GSD-2021-1001932: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells. Affects Kernel versions >= 69aba7948cbe53f2f1827e84e9dd0ae470a5072e, < 60df06bbdf497e37ed25ad40572c362e5b0998df. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nvmem package is a component of the Linux Kernel, which provides an interface for accessing non-volatile memory devices. It allows reading and writing data to these devices, which are commonly used for storing system configuration and calibration data. The nvmem package is an essential part of the Linux Kernel and is widely used in various embedded systems and devices.
Vulnerability Detail
The identified vulnerability in the nvmem package is related to a shift-out-of-bound issue. This vulnerability can be triggered when byte size cells are used, leading to undefined behavior and potential security risks. Although the impact and attack plausibility have not been proven, this vulnerability has the potential to be exploited by malicious actors to gain unauthorized access, manipulate data, or cause system instability. The vulnerability was introduced in version v4.3 of the Linux Kernel and has been fixed in version v4.9.288.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using byte size cells in the nvmem package. Instead, it is recommended to use other cell sizes that do not trigger the shift-out-of-bound issue. However, this workaround may not be feasible in all scenarios and it is strongly advised to apply the official fix by updating the Linux Kernel.
Conclusion
The shift-out-of-bound vulnerability in the nvmem package of the Linux Kernel can pose potential security risks. It is crucial to update the Linux Kernel to version v4.9.288 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The nvmem package is a component of the Linux Kernel that provides an interface for accessing non-volatile memory devices.
The impact of this vulnerability is not yet proven, but it has the potential to be exploited by malicious actors to gain unauthorized access, manipulate data, or cause system instability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.9.288 or later.
A workaround is to avoid using byte size cells in the nvmem package and use other cell sizes instead.
Detailed instructions on how to update the Linux Kernel can be found in the official documentation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
