netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
Summary
GSD-2021-1002679: netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc. Affects Kernel versions >= 395cacb5f1a0a290f1ae9ca4692c400d2b57a705, < 699e794c12a3cd79045ff135bc87a53b97024e43. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netdevsim package is a part of the Linux Kernel ecosystem. It provides a network device simulator that allows testing and development of network-related features without the need for physical hardware. The package includes various functionalities and components for simulating network devices and their behavior.
Vulnerability Detail
The vulnerability identified in netdevsim is related to the function nsim_bpf_map_alloc. In this function, memory for a new map's value is not properly zero-initialized. This can lead to uninitialized memory being used, potentially resulting in information disclosure or other security issues. The vulnerability was introduced in version v4.16 of the Linux Kernel and has been fixed in version v5.4.168.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The netdevsim package in the Linux Kernel is vulnerable to a memory initialization issue in the nsim_bpf_map_alloc function. This vulnerability can potentially lead to information disclosure or other security issues. It is recommended to update the Linux Kernel to version v5.4.168 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netdevsim is a network device simulator included in the Linux Kernel ecosystem. It allows testing and development of network-related features without physical hardware.
The vulnerability can potentially lead to information disclosure or other security issues due to the use of uninitialized memory.
To fix this vulnerability, update the Linux Kernel to version v5.4.168 or later, which includes the necessary fix.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) or by contacting the Linux Kernel development team.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
