netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
Summary
GSD-2021-1002704: netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc. Affects Kernel versions >= 395cacb5f1a0a290f1ae9ca4692c400d2b57a705, < 1a34fb9e2bf3029f7c0882069d67ff69cbd645d8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netdevsim package is a part of the Linux Kernel ecosystem. It provides a network device simulator that allows testing and development of network-related features without the need for physical hardware. The package includes various functionalities and components for simulating network devices.
One of the components in netdevsim is the nsim_bpf_map_alloc function, which is responsible for allocating memory for a new map's value. However, there is a vulnerability in this function that leads to uninitialized memory being used for the new map's value.
Vulnerability Detail
The vulnerability in netdevsim's nsim_bpf_map_alloc function occurs due to the failure to zero-initialize the memory for a new map's value. This can result in the use of uninitialized memory, leading to potential security risks. An attacker could potentially exploit this vulnerability to read sensitive information or execute arbitrary code in the context of the affected process.
The vulnerability was introduced in version v4.16 of the Linux Kernel and has been fixed in version v5.10.88. The fix ensures that the memory for a new map's value is properly zero-initialized.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the Linux Kernel to the fixed version.
Conclusion
The netdevsim package in the Linux Kernel is vulnerable to a zero-initialization issue in the nsim_bpf_map_alloc function. This vulnerability can potentially be exploited to read sensitive information or execute arbitrary code. It is recommended to update the Linux Kernel to version v5.10.88 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netdevsim is a network device simulator in the Linux Kernel ecosystem. It allows testing and development of network-related features without physical hardware.
The nsim_bpf_map_alloc function is a component in netdevsim responsible for allocating memory for a new map's value.
The vulnerability can potentially allow an attacker to read sensitive information or execute arbitrary code in the context of the affected process.
To fix this vulnerability, update the Linux Kernel to version v5.10.88 or later.
There is no specific workaround mentioned for this vulnerability. Updating the Linux Kernel is the recommended approach.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
