netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
Summary
GSD-2021-1002752: netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc. Affects Kernel versions >= 395cacb5f1a0a290f1ae9ca4692c400d2b57a705, < 27358aa81a7d60e6bd36f0bb1db65cd084c2cad0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netdevsim package is a part of the Linux Kernel ecosystem. It provides a network device simulator that allows testing and development of network-related features without the need for physical hardware. The package includes various functionalities and components for simulating network devices and their behavior.
Vulnerability Detail
The vulnerability in netdevsim arises from the improper initialization of memory for a new map's value in the function nsim_bpf_map_alloc. This issue was introduced in version v4.16 of the Linux Kernel and was fixed in version v5.15.11. The vulnerability could potentially be exploited by an attacker to manipulate or access uninitialized memory, leading to information disclosure or arbitrary code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The netdevsim package in the Linux Kernel was found to have a vulnerability that could allow unauthorized access to uninitialized memory. It is recommended to update the Linux Kernel to version v5.15.11 or later to fix this issue. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netdevsim is a network device simulator included in the Linux Kernel ecosystem. It allows testing and development of network-related features without the need for physical hardware.
The vulnerability could potentially allow an attacker to manipulate or access uninitialized memory, leading to information disclosure or arbitrary code execution.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.11 or later, which includes the necessary fix.
No specific workaround has been mentioned for this vulnerability.
For more information about this vulnerability, you can refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
