Vulnerability in Kernel: hamradio: defer ax25 kfree after unregister_netdev
Summary
GSD-2021-1002782: hamradio: defer ax25 kfree after unregister_netdev. Affects Kernel versions < eaa816a86e629cbcc0a94f38391fee09231628c7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities for the proper functioning of the system. The hamradio module within the Kernel enables support for amateur radio protocols and devices. It allows users to connect and communicate over radio frequencies. However, a vulnerability has been identified in the hamradio module that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the hamradio module arises from a failure to properly handle memory deallocation. Specifically, the ax25 function does not defer the freeing of resources after unregistering the network device. This oversight can lead to a use-after-free scenario, where an attacker could manipulate the freed memory to execute arbitrary code or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v4.14.260 by commit eaa816a86e629cbcc0a94f38391fee09231628c7.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable or remove the hamradio module if it is not required for their system. This can be done by unloading the module or excluding it from the Kernel configuration during compilation. However, this workaround should only be considered if the hamradio functionality is not essential, as it may impact the intended usage of the system.
Conclusion
The hamradio module in the Linux Kernel is vulnerable to a use-after-free issue due to improper memory deallocation. This vulnerability can potentially be exploited to execute arbitrary code or cause denial-of-service. It is crucial to update the Kernel to version v4.14.260 or later to mitigate this vulnerability. Alternatively, users can disable or remove the hamradio module if it is not required. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The hamradio module is a component of the Linux Kernel that provides support for amateur radio protocols and devices. It allows users to connect and communicate over radio frequencies.
The impact of this vulnerability is not yet proven. However, if exploited, it could lead to arbitrary code execution or denial-of-service conditions.
To fix this vulnerability, update the Linux Kernel to version v4.14.260 or later. Apply relevant patches or upgrade the Kernel to a version that includes the fix.
Yes, if the hamradio functionality is not required, you can disable or remove the module. Unload the module or exclude it from the Kernel configuration during compilation.
No known exploit for this vulnerability has been reported at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
