Double Free Vulnerability in igbvf
Summary
GSD-2021-1002677: igbvf: fix double free in igbvf_probe. Affects Kernel versions >= d4e0fe01a38a073568aee541a0247fe734095979, < 8addba6cab94ce01686ea2e80ed1530f9dc33a9a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The igbvf package is a component of the Linux Kernel, which is responsible for providing support for Intel Gigabit Ethernet Virtual Function (VF) devices. It allows virtual machines to access the network through a physical Ethernet controller. The igbvf_probe function is a part of the igbvf package and is used to initialize the VF device. However, a double free vulnerability has been discovered in this function.
Vulnerability Detail
The double free vulnerability in igbvf_probe can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The vulnerability occurs when the function attempts to free a resource that has already been freed, leading to memory corruption. An attacker could craft a malicious request to trigger this vulnerability and potentially gain control over the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality by unloading the igbvf module or preventing its loading. This can be achieved by running the following commands as root:
rmmod igbvf
However, it is strongly recommended to apply the official fix as soon as possible.
Conclusion
The double free vulnerability in igbvf can have severe consequences, including a potential DoS condition or arbitrary code execution with kernel privileges. It is crucial to update the Linux Kernel to the recommended version and apply the fix as soon as possible. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the affected system.
The recommended mitigation is to apply the official fix provided by updating the Linux Kernel to version v5.4.168 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
