Use-after-free vulnerability in net/mlx4_en
Summary
GSD-2021-1002419: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources(). Affects Kernel versions >= ec25bc04ed8e12947738468cbe2191f1529f9e39, < 676dc7d9b15bf8733233a2db1ec3f9091ab34275. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/mlx4_en package is a network driver for Mellanox ConnectX-3 and ConnectX-3 Pro Ethernet adapters. It provides support for Mellanox Technologies' 10/40 Gigabit Ethernet adapters, allowing for high-speed network connectivity. The package is a part of the Linux Kernel ecosystem.
Vulnerability Detail
The vulnerability in net/mlx4_en is a use-after-free bug that occurs in the mlx4_en_try_alloc_resources() function. This bug was introduced in version v4.7 of the Linux Kernel by commit ec25bc04ed8e12947738468cbe2191f1529f9e39 and affects all versions until v4.19.220. The bug can be exploited by an attacker to potentially execute arbitrary code or cause a denial-of-service (DoS) condition. The bug occurs when the mlx4_en_try_alloc_resources() function attempts to allocate resources but fails, leading to a use-after-free condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel to the recommended version.
Conclusion
The use-after-free vulnerability in net/mlx4_en can be fixed by updating the Linux Kernel to version v4.19.220 or later. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial-of-service condition. It is important to apply the fix to ensure the security and stability of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net/mlx4_en is a network driver for Mellanox ConnectX-3 and ConnectX-3 Pro Ethernet adapters, providing support for high-speed network connectivity.
A use-after-free bug occurs when a program continues to use a memory address after it has been freed, leading to potential security vulnerabilities.
This vulnerability can be exploited by an attacker to potentially execute arbitrary code or cause a denial-of-service (DoS) condition.
Versions of the Linux Kernel from v4.7 to v4.19.220 are affected by this vulnerability.
No, there is no known workaround. It is recommended to update the Linux Kernel to the recommended version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
