Vulnerability in Kernel package: s390/pci: fix zpci_zdev_put() on reserve
Summary
GSD-2021-1002054: s390/pci: fix zpci_zdev_put() on reserve. Affects Kernel versions >= a69326e134d4ffa0d2d77bf1a4a62271c51c3051, < 188907c252188ac7a5ec3efcfa31dae1f47b8a20. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware and software components. The s390/pci module within the Kernel package specifically handles PCI device management for IBM System z architectures. It allows for the configuration and control of PCI devices on these systems.
Vulnerability Detail
The vulnerability identified in the s390/pci module is related to the zpci_zdev_put() function when used on reserve. The function is responsible for releasing a reserved PCI device, but due to a coding error, it may not properly handle the release operation. This vulnerability could potentially be exploited by an attacker to manipulate the state of a reserved PCI device, leading to unauthorized access or other security issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Kernel package to the latest version.
Conclusion
In conclusion, the s390/pci module in the Kernel package is vulnerable to a coding error in the zpci_zdev_put() function when used on reserve. This vulnerability could potentially allow unauthorized access or manipulation of reserved PCI devices. To mitigate this risk, it is crucial to update the Kernel package to version v5.10.76 or later. For further support and assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to manipulate the state of a reserved PCI device, leading to unauthorized access or other security issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are detected.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
The specific details regarding remote exploitation have not been provided. However, it is always recommended to apply security patches and updates to prevent any potential remote exploitation.
For more detailed information about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
