Use-after-free bug in mlx4_en_try_alloc_resources() in Kernel
Summary
GSD-2021-1002449: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources(). Affects Kernel versions >= ec25bc04ed8e12947738468cbe2191f1529f9e39, < e461a9816a1ac5b4aeb61621b817225b61e46a68. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces between hardware and software. It manages system resources, facilitates communication between different components, and ensures the stability and security of the system. The mlx4_en module is a network driver for Mellanox ConnectX-3 and ConnectX-3 Pro Ethernet adapters. It enables network connectivity and data transmission for these devices. However, a use-after-free bug has been discovered in the mlx4_en_try_alloc_resources() function of the mlx4_en module, which can lead to potential security vulnerabilities.
Vulnerability Detail
The use-after-free bug in mlx4_en_try_alloc_resources() is a memory management issue that occurs when a program continues to reference a memory location after it has been freed. This can result in various consequences, including crashes, data corruption, and potential security exploits. Attackers may be able to manipulate the freed memory to execute arbitrary code, escalate privileges, or cause denial-of-service conditions. The vulnerability was introduced in version v4.7 of the Linux Kernel and has been fixed in version v5.4.164.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed version of the Linux Kernel as mentioned in the 'how_to_fix' section.
Conclusion
The use-after-free bug in mlx4_en_try_alloc_resources() in the Kernel can pose significant security risks if left unaddressed. It is crucial to update to the fixed version of the Linux Kernel (v5.4.164 or later) to mitigate these vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially be exploited by attackers to execute arbitrary code, escalate privileges, or cause denial-of-service conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the fix promptly to mitigate any potential risks.
Yes, this vulnerability can be remotely exploited if an attacker can establish a network connection to the affected system.
If updating the Kernel is not immediately feasible, it is recommended to implement other security measures such as network segmentation, access controls, and intrusion detection systems to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
