Use After Free Vulnerability in sja1000 Package
Summary
GSD-2021-1002397: can: sja1000: fix use after free in ems_pcmcia_add_card(). Affects Kernel versions >= fd734c6f25aea4b2b44b045e489aec67b388577e, < c8718026ba287168ff9ad0ccc4f9a413062cba36. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sja1000 package is a component of the Linux Kernel, which is responsible for handling CAN (Controller Area Network) communication. The sja1000 driver provides support for various CAN controllers, allowing devices to communicate over a CAN bus. The vulnerability in question is a use after free issue that affects the ems_pcmcia_add_card() function within the sja1000 package.
Vulnerability Detail
The use after free vulnerability in ems_pcmcia_add_card() can be exploited by an attacker to execute arbitrary code or cause a denial of service. This vulnerability occurs when the function attempts to access memory that has already been freed, leading to unpredictable behavior. An attacker could potentially exploit this issue by carefully crafting a malicious input that triggers the use after free condition, allowing them to gain unauthorized access or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the affected functionality or remove the sja1000 driver from the system. However, it is important to note that these workarounds may impact the functionality of devices relying on the CAN communication provided by the sja1000 driver.
Conclusion
In conclusion, the use after free vulnerability in ems_pcmcia_add_card() within the sja1000 package of the Linux Kernel can lead to arbitrary code execution or denial of service. It is crucial to update the Linux Kernel to version v4.14.258 or later to mitigate this vulnerability. If immediate updating is not possible, consider applying the mentioned workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the use after free issue in ems_pcmcia_add_card().
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this use after free vulnerability.
Yes, a patch for this vulnerability is available in the Linux Kernel version v4.14.258 and later. Updating to the latest version of the Linux Kernel will address this issue.
If updating the Linux Kernel is not immediately feasible, you can consider disabling the affected functionality or removing the sja1000 driver from the system as a temporary workaround. However, these workarounds may impact the functionality of devices relying on the CAN communication provided by the sja1000 driver.
You can find more information about this vulnerability in the GSD-2021-1002397 entry of the GSD database maintained by the Cloud Security Alliance. The source link is available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002397.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
