Out-of-Bounds Read and Write in hw_atl_utils_fw_rpc_wait in atlantic
Summary
GSD-2021-1002481: atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait. Affects Kernel versions < 2c514d25003ac89bb7716bb4402918ccb141f8f5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The atlantic package is a component of the Linux Kernel, which is responsible for managing network interfaces. It provides support for the Atheros L2 Ethernet adapter. The hw_atl_utils_fw_rpc_wait function in atlantic is used for firmware RPC (Remote Procedure Call) communication. This vulnerability affects the function, leading to out-of-bounds read and write operations.
Vulnerability Detail
The vulnerability in hw_atl_utils_fw_rpc_wait allows an attacker to read or write data outside the boundaries of the intended memory region. This can result in various consequences, such as information disclosure, system crashes, or even remote code execution. The issue arises due to improper input validation and handling within the function. An attacker could exploit this vulnerability by sending specially crafted requests to the affected system, triggering the out-of-bounds access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the atlantic package in the Linux Kernel is vulnerable to an out-of-bounds read and write issue in the hw_atl_utils_fw_rpc_wait function. This vulnerability can have severe consequences, including information disclosure, system crashes, or remote code execution. It is crucial to update the Linux Kernel to version v5.10.84 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to information disclosure, system crashes, or remote code execution, depending on how it is exploited.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the patched version.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can find more information about this vulnerability in the GSD-2021-1002481 entry of the GSD database at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002481.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
