Use-after-free of the add_lock mutex in Kernel
Summary
GSD-2021-1002308: spi: fix use-after-free of the add_lock mutex. Affects Kernel versions >= 6098475d4cb48d821bdf453c61118c56e26294f0, < 37330f37f6666c7739a44b2b6b95b047ccdbed2d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The add_lock mutex is a synchronization mechanism used within the Kernel to control access to certain resources. However, a use-after-free vulnerability has been discovered in the add_lock mutex, which could lead to security breaches and system instability.
Vulnerability Detail
The use-after-free vulnerability in the add_lock mutex occurs when the mutex is accessed after it has been freed. This can result in unintended modifications of data or execution of arbitrary code. An attacker could potentially exploit this vulnerability to gain unauthorized access, escalate privileges, or cause denial-of-service conditions. The vulnerability was introduced in version v5.15 of the Linux Kernel and has been fixed in version v5.15.5.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.5 or later. This update includes the commit 37330f37f6666c7739a44b2b6b95b047ccdbed2d, which addresses the use-after-free issue in the add_lock mutex. Updating the Kernel ensures that the vulnerability is patched and the system is protected.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually by cherry-picking the commit 37330f37f6666c7739a44b2b6b95b047ccdbed2d to their existing Kernel version. Here is an example of how to apply the patch using the git command:
git cherry-pick 37330f37f6666c7739a44b2b6b95b047ccdbed2d
It is important to note that this workaround is temporary, and it is strongly recommended to update to the latest stable version of the Linux Kernel as soon as possible.
Conclusion
The use-after-free vulnerability in the add_lock mutex of the Kernel can pose significant security risks and system instability. It is crucial to update the Linux Kernel to version v5.15.5 or later to mitigate this vulnerability. Applying the provided patch or cherry-picking the relevant commit can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The use-after-free vulnerability in the add_lock mutex can potentially allow attackers to gain unauthorized access, escalate privileges, or cause denial-of-service conditions.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the necessary updates or patches to mitigate the risk.
Yes, you can apply the patch manually by cherry-picking the commit 37330f37f6666c7739a44b2b6b95b047ccdbed2d to your existing Kernel version. Refer to the 'workaround' section for detailed instructions.
You can find more information about this vulnerability in the GSD-2021-1002308 entry of the GSD Database maintained by the Cloud Security Alliance. The link to the specific entry is provided in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.