Vulnerability in Kernel Package: Array Overflow in hns_dsaf_ge_srst_by_port()
Summary
GSD-2021-1002373: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port(). Affects Kernel versions < 948968f8747650447c8f21c9fdba0e1973be040b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing core system functions and providing an interface between hardware and software. It includes various drivers and modules to support different hardware devices. One of these modules is the hns (Hisilicon Network Subsystem) module, which handles Ethernet functionality for Hisilicon network devices. The hns_dsaf_misc module within hns is responsible for miscellaneous operations, including resetting the Gigabit Ethernet (GE) subsystem. However, a vulnerability has been discovered in the hns_dsaf_ge_srst_by_port() function, which could lead to an array overflow.
Vulnerability Detail
The vulnerability in the hns_dsaf_ge_srst_by_port() function of the hns_dsaf_misc module could allow an attacker to trigger an array overflow. This could potentially lead to memory corruption, system crashes, or even remote code execution. The vulnerability arises from improper bounds checking when handling user-supplied input. An attacker could exploit this vulnerability by sending specially crafted input to the affected function, causing it to write beyond the boundaries of an array. This could result in overwriting adjacent memory locations and potentially executing arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Kernel package, there is no specific workaround available. Users are advised to update their Kernel package to the patched version.
Conclusion
The vulnerability in the hns_dsaf_ge_srst_by_port() function of the hns_dsaf_misc module in the Kernel package could allow an attacker to trigger an array overflow, potentially leading to memory corruption or remote code execution. It is crucial to update the Kernel package to the latest available version to mitigate this vulnerability. Regularly updating the Kernel package is essential to ensure the application of security patches and bug fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code, leading to system compromise, data theft, or unauthorized access.
Yes, this vulnerability can be exploited remotely if the affected system is exposed to network-based attacks.
No, the vulnerability is fixed in Linux Kernel version v4.9.292 and later. Users should update to the latest available version to mitigate the risk.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is important to apply the necessary updates to protect against potential future attacks.
For more information about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
