Vulnerability in Kernel: UAF in peak_pci_remove()
Summary
GSD-2021-1002040: can: peak_pci: peak_pci_remove(): fix UAF. Affects Kernel versions >= e6d9c80b7ca1504411ad6d7acdb8683e4ae1c9cd, < 28f28e4bc3a5e0051faa963f10b778ab38c1db69. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities for the system's operation. However, a vulnerability has been discovered in the Kernel's peak_pci_remove() function, which can lead to a use-after-free (UAF) condition. This vulnerability was introduced in version v3.4 and affects all subsequent versions until v5.10.76.
Vulnerability Detail
The vulnerability arises due to a use-after-free (UAF) condition in the peak_pci_remove() function of the Kernel. This function is responsible for handling the removal of a PCI device. By exploiting this vulnerability, an attacker could potentially execute arbitrary code or cause a denial-of-service (DoS) condition. The UAF occurs when the function attempts to access memory that has already been freed, leading to unpredictable behavior and potential security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply patches or backports provided by their Linux distribution's security team. These patches will address the UAF vulnerability in the Kernel without requiring a complete Kernel update. It is advisable to consult the official documentation or security advisories of the specific Linux distribution for detailed instructions on applying the patches.
Conclusion
In conclusion, a use-after-free (UAF) vulnerability has been identified in the Kernel's peak_pci_remove() function. This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. To mitigate this risk, it is crucial to update the Linux Kernel to version v5.10.76 or later. Alternatively, users can apply patches or backports provided by their Linux distribution's security team. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition on a system running an affected version of the Linux Kernel.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this specific UAF vulnerability in the Kernel.
At the time of this report, there is no known public exploit for this vulnerability. However, it is crucial to apply the recommended fixes and keep the Kernel up to date to mitigate any potential risks.
This vulnerability requires local access to the system to exploit. It cannot be exploited remotely over a network connection.
If updating the Kernel is not immediately feasible, you can apply patches or backports provided by your Linux distribution's security team. These patches will address the UAF vulnerability without requiring a complete Kernel update. However, it is still recommended to update to the latest stable version of the Kernel as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
