Vulnerability in hamradio package: defer ax25 kfree after unregister_netdev
Summary
GSD-2021-1002798: hamradio: defer ax25 kfree after unregister_netdev. Affects Kernel versions < ef5f7bfa19e3fc366f4c6d1a841ceaddf7a9f5d4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hamradio package is a component of the Linux Kernel ecosystem. It provides support for amateur radio communication protocols. The ax25 module within the hamradio package is responsible for handling AX.25 network interfaces. This vulnerability specifically affects the ax25 module when freeing resources after unregistering a network device.
Vulnerability Detail
The vulnerability in the hamradio package allows an attacker to potentially exploit a race condition when freeing resources in the ax25 module. By unregistering a network device, the ax25 module may attempt to free resources before they are fully released, leading to a use-after-free vulnerability. This could result in a variety of security issues, including privilege escalation or denial of service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating the Linux Kernel to the patched version is the recommended solution.
Conclusion
The hamradio package in the Linux Kernel is vulnerable to a use-after-free issue in the ax25 module. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.4.169 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The hamradio package is a component of the Linux Kernel ecosystem that provides support for amateur radio communication protocols.
The ax25 module is a part of the hamradio package and is responsible for handling AX.25 network interfaces.
A use-after-free vulnerability occurs when a program continues to use a memory resource after it has been freed. This can lead to various security issues.
The vulnerability could potentially be exploited for privilege escalation or denial of service attacks.
To fix this vulnerability, update the Linux Kernel to version v5.4.169 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
