Vulnerability in Kernel package: Array Overflow in hns_dsaf_ge_srst_by_port()
Summary
GSD-2021-1002390: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port(). Affects Kernel versions < abbd5faa0748d0aa95d5191d56ff7a17a6275bd1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It includes various subsystems and drivers to enable proper functioning of the system. One of the subsystems is the Ethernet subsystem, which handles network communication. Within the Ethernet subsystem, the hns_dsaf_misc module is responsible for managing certain features related to the HiSilicon network switch (HNS) chipsets. However, a vulnerability has been identified in the hns_dsaf_misc module that could lead to an array overflow in the hns_dsaf_ge_srst_by_port() function.
Vulnerability Detail
The vulnerability in the hns_dsaf_ge_srst_by_port() function of the hns_dsaf_misc module could potentially result in an array overflow. An attacker could exploit this vulnerability by sending specially crafted input to the affected system, causing the array to overflow and potentially leading to arbitrary code execution or a system crash. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v4.14.257 by commit abbd5faa0748d0aa95d5191d56ff7a17a6275bd1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the Kernel package in Linux is vulnerable to an array overflow in the hns_dsaf_ge_srst_by_port() function of the hns_dsaf_misc module. This vulnerability can potentially lead to arbitrary code execution or a system crash. It is crucial to update the Linux Kernel to version v4.14.257 or later to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to arbitrary code execution or a system crash if exploited by an attacker.
You can use the Vulert playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
No known exploit for this vulnerability has been reported at this time.
The recommended approach to mitigate this vulnerability is to update the Linux Kernel to the fixed version. However, if updating is not immediately feasible, it is advisable to implement other security measures such as network segmentation, access controls, and monitoring to reduce the risk of exploitation.
You can find more information about this vulnerability, including the source and references, in the GSD-2021-1002390 JSON file available on the GitHub repository of the Cloud Security Alliance's GSD Database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
