Vulnerability in Kernel package: ipmi: ssif: initialize ssif_info->client early
Summary
GSD-2021-1002795: ipmi: ssif: initialize ssif_info->client early. Affects Kernel versions >= c4436c9149c5d2bc0c49ab57ec85c75ea1c4d61c, < 8efd6a3391f7b0b19fb0c38e50add06ca30c94af. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services and interfaces for hardware, software, and user applications. The ipmi module within the Kernel package is responsible for handling Intelligent Platform Management Interface (IPMI) communication. IPMI is a standardized interface used for remote management and monitoring of computer systems. This vulnerability specifically affects the ssif component of the ipmi module.
Vulnerability Detail
The vulnerability in the ssif component of the ipmi module arises from a failure to properly initialize the ssif_info->client structure. This can lead to various security issues, although the exact impact and attack vectors have not been proven. The vulnerability was introduced in version v5.4 of the Linux Kernel by commit c4436c9149c5d2bc0c49ab57ec85c75ea1c4d61c and has been fixed in version v5.4.169 by commit 8efd6a3391f7b0b19fb0c38e50add06ca30c94af.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable or restrict access to the ipmi module if it is not essential for their system's functionality. This can be achieved by modifying the Kernel configuration and removing the module or by using appropriate access control mechanisms to limit access to the module.
Conclusion
In conclusion, the Kernel package's ipmi ssif component is vulnerable to a security issue that can be mitigated by updating to version v5.4.169 or later. It is recommended to follow the official update process or manually compile and install the updated Kernel version. If the ipmi module is not essential, it can be disabled or access can be restricted as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a core component of the Linux operating system, responsible for managing system resources and providing essential services and interfaces.
The ipmi module is a component of the Kernel package that handles Intelligent Platform Management Interface (IPMI) communication, allowing for remote management and monitoring of computer systems.
The ssif component of the ipmi module is specifically responsible for certain aspects of IPMI communication, and it is affected by the vulnerability described in this report.
The exact impact and attack vectors of this vulnerability have not been proven. However, if exploited, it could potentially lead to security breaches, unauthorized access, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
