UAF Vulnerability in sata_fsl Package
Summary
GSD-2021-1002359: sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl. Affects Kernel versions >= faf0b2e5afe7dae072d2715763c7f992b612b628, < cdcd80292106df5cda325426e96495503e41f947. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sata_fsl package is a component of the Linux Kernel ecosystem. It provides support for SATA controllers based on the Freescale PowerPC architecture. The package enables communication between the SATA controller and the operating system, facilitating data transfer to and from SATA devices. However, a vulnerability has been identified in the sata_fsl package that could lead to a use-after-free (UAF) scenario.
Vulnerability Detail
The UAF vulnerability in the sata_fsl package occurs during the execution of the sata_fsl_port_stop function when the sata_fsl module is unloaded using the rmmod command. This vulnerability was introduced in version v2.6.24 of the Linux Kernel and affects all subsequent versions until v4.4.294. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The vulnerability has been fixed in Linux Kernel version v4.4.294 by commit cdcd80292106df5cda325426e96495503e41f947.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.4.294 or later. This can be done by obtaining the latest stable version of the Linux Kernel from the official repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and following the installation instructions provided. Alternatively, users can rely on their Linux distribution's package manager to update the Kernel to a patched version.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the sata_fsl package in the Linux Kernel is vulnerable to a use-after-free (UAF) scenario. This vulnerability can be exploited to execute arbitrary code or cause a denial-of-service (DoS) condition. It is crucial to update the Linux Kernel to version v4.4.294 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The sata_fsl package is a component of the Linux Kernel ecosystem that provides support for SATA controllers based on the Freescale PowerPC architecture.
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed. This can lead to various security issues, including the execution of arbitrary code or a denial-of-service (DoS) condition.
The sata_fsl UAF vulnerability can be exploited by unloading the sata_fsl module using the rmmod command. This triggers the use-after-free scenario and allows an attacker to potentially execute arbitrary code or cause a DoS condition.
The vulnerability was introduced in version v2.6.24 of the Linux Kernel and affects all subsequent versions until v4.4.294.
Yes, the sata_fsl UAF vulnerability has been fixed in Linux Kernel version v4.4.294 by commit cdcd80292106df5cda325426e96495503e41f947.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.