UAF Vulnerability in ipmi_si and ipmi_msghandler Modules of Kernel
Summary
GSD-2021-1002825: ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module. Affects Kernel versions >= b2cfd8ab4add53c2070367bfee2f5b738f51698d, < 6b3f7e4b10f343f05b5fb513b07a9168fbf1172e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The ipmi_si and ipmi_msghandler modules are part of the Kernel and are responsible for handling IPMI (Intelligent Platform Management Interface) messages and system interface. IPMI is a standardized interface used for managing and monitoring computer systems. These modules play a vital role in facilitating IPMI communication and functionality within the Linux Kernel.
Vulnerability Detail
The UAF (Use-After-Free) vulnerability in the ipmi_si and ipmi_msghandler modules occurs when these modules are uninstalled. This vulnerability allows an attacker to exploit a dangling pointer, leading to potential memory corruption or arbitrary code execution. The vulnerability was introduced in version v4.15 of the Linux Kernel and has been fixed in version v5.15.12. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid uninstalling the ipmi_si and ipmi_msghandler modules. By keeping these modules installed, the UAF vulnerability can be mitigated. However, it is still strongly advised to update the Kernel to the latest version to ensure comprehensive security.
Conclusion
The UAF vulnerability in the ipmi_si and ipmi_msghandler modules of the Linux Kernel can potentially lead to memory corruption or arbitrary code execution. It is crucial to update the Kernel to version v5.15.12 or later to fix this vulnerability. Keeping the ipmi_si and ipmi_msghandler modules installed can serve as a temporary workaround, but updating the Kernel is strongly recommended for comprehensive security. For further assistance, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to memory corruption or arbitrary code execution, potentially compromising the security and stability of the system.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert analyzes the manifest file, such as package-lock.json, to identify and alert in real-time for open-source vulnerabilities.
Yes, you can keep the ipmi_si and ipmi_msghandler modules installed to mitigate the UAF vulnerability. However, it is strongly recommended to update the Kernel to the latest version as soon as possible to ensure comprehensive security.
You can refer to the official Linux Kernel website at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ for more information about the updates, including the specific commits that address this vulnerability.
For further support on vulnerability remediation, you can reach out to info@devnack.com. Our team will be happy to assist you in addressing any concerns or queries related to this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
