Vulnerability in asix package: Uninitialized value in asix_mdio_read()
Summary
GSD-2021-1002824: asix: fix uninit-value in asix_mdio_read(). Affects Kernel versions >= d9fe64e511144c1ee7d7555b4111f09dde9692ef, < d259f621c85949f30cc578cac813b82bb5169f56. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The asix package is a driver for ASIX AX88xxx Based USB 2.0 Ethernet Adapters. It provides support for these adapters, allowing them to be used for network connectivity. The vulnerability in question is related to the asix_mdio_read() function within the package.
Vulnerability Detail
The vulnerability arises from an uninitialized value in the asix_mdio_read() function. This can lead to potential security issues, although the exact impact and likelihood of an attack have not been proven. The vulnerability was introduced in version v4.9 of the Linux Kernel by commit d9fe64e511144c1ee7d7555b4111f09dde9692ef and has been fixed in version v5.15.12 by commit d259f621c85949f30cc578cac813b82bb5169f56.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the asix package is vulnerable to an uninitialized value issue in the asix_mdio_read() function. It is recommended to update the Linux Kernel to version v5.15.12 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as the attack plausibility has not been proven. However, it is always recommended to apply security patches to mitigate potential risks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
As of now, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to ensure the security of your system.
It is recommended to update the Linux Kernel to the fixed version mentioned above. Manual patching may be complex and error-prone, so it is best to rely on official updates.
You can find more information about this vulnerability in the official GitHub repository of the Cloud Security Alliance's GSD Database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002824.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
