inet_diag: Fix Kernel-Infoleak for UDP Sockets in Linux Kernel
Summary
GSD-2021-1002740: inet_diag: fix kernel-infoleak for UDP sockets. Affects Kernel versions >= 3c4d05c8056724aff3abc20650807dd828fded54, < e5d28205bf1de7082d904ed277ceb2db2879e302. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a critical component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It includes various subsystems, such as networking, file systems, and device drivers. The inet_diag module is part of the networking subsystem and provides a mechanism for querying and manipulating network socket information. UDP (User Datagram Protocol) is a connectionless transport protocol that allows applications to send datagrams over an IP network.
This vulnerability in the inet_diag module allows an attacker to leak kernel information through UDP sockets. By exploiting this vulnerability, an attacker may be able to obtain sensitive information from the kernel, potentially leading to further attacks or unauthorized access.
Vulnerability Detail
The vulnerability in the inet_diag module allows an attacker to leak kernel information for UDP sockets. This can be exploited by sending specially crafted packets to a vulnerable system. The vulnerability was introduced in Linux Kernel version 3.3 and was fixed in version 5.15.11. The impact and attack plausibility of this vulnerability have not been proven yet.
The specific technical details of this vulnerability have not been provided in the vulnerability report.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned in the vulnerability report.
Conclusion
The vulnerability in the inet_diag module of the Linux Kernel allows for kernel-infoleak through UDP sockets. It is recommended to update the Linux Kernel to version 5.15.11 or later to fix this vulnerability. No specific workaround has been provided. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, an attacker may be able to leak sensitive kernel information, potentially leading to further attacks or unauthorized access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for open-source vulnerabilities, including this one.
No known exploits for this vulnerability have been mentioned in the vulnerability report.
No CVE (Common Vulnerabilities and Exposures) identifier has been mentioned in the vulnerability report.
For more information about this vulnerability, you can refer to the vulnerability report in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002740.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
