Out-of-Bound Array Access in net: tulip: de4x5
Summary
GSD-2021-1002485: net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound. Affects Kernel versions < f059fa40f0fcc6bc7a12e0f2a2504e9a4ff74f1f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: tulip: de4x5 package is a component of the Linux Kernel, which is responsible for managing network interfaces. The de4x5 driver specifically handles network cards based on the DECchip 21140 Ethernet controller. This vulnerability affects the package by allowing an out-of-bound array access in the 'lp->phy[8]' array.
Vulnerability Detail
The vulnerability in net: tulip: de4x5 arises from the potential for the 'lp->phy[8]' array to be accessed out of bounds. This can lead to various issues, including memory corruption, crashes, and potential privilege escalation. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial of service. The vulnerability has been fixed in Linux Kernel version v5.10.84 by commit f059fa40f0fcc6bc7a12e0f2a2504e9a4ff74f1f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The out-of-bound array access vulnerability in net: tulip: de4x5 can have serious consequences, including memory corruption and potential privilege escalation. It is crucial to update the Linux Kernel to version v5.10.84 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net: tulip: de4x5 is a component of the Linux Kernel responsible for managing network interfaces, specifically for network cards based on the DECchip 21140 Ethernet controller.
The vulnerability allows for out-of-bound array access, which can lead to memory corruption, crashes, and potential privilege escalation. It may be possible for an attacker to execute arbitrary code or cause a denial of service.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.84 or later.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
